Question

我正在为我的网站制作登录表单。当我在登录表单上单击“提交”时，它似乎不会运行SELECT语句，因为它在我的代码中。

$result = $mysqli_conn->query("SELECT * FROM user WHERE email = '$emailclean' AND password = '$passwordclean'");

    if($row = mysqli_fetch_assoc($result)){

      $finalmessager['success'] = 'You are logged in';
      $_SESSION['finalmessager']= $finalmessager;
    }else{
      $finalmessager['fail'] = 'You are not logged in';
      $_SESSION['finalmessager']= $finalmessager;
    }

似乎确定了$ emailclean但它似乎没有读取$ passwordclean。但是，当我尝试手动输入密码时，如

$result = $mysqli_conn->query("SELECT * FROM user WHERE email = '$emailclean' AND password = 'celenelqdekdnnd.......'");

它似乎工作正常。

我在这里做错了什么？

这是我的代码：

require "../config/init.php";
require "../config/config.php";
if(isset($_POST['submit'])){

$passwordclean = mysqli_real_escape_string($mysqli_conn, hash("sha512", $_POST['password']));
$emailclean= mysqli_real_escape_string($mysqli_conn, $_POST['email']);


$errorCheckr = array(); //an array is introduced to check errors
$finalmessager = array();//an array to display final message

if (empty($emailclean)) {
    $errorCheckr['emailcheck'] = 'Please enter your email';

}else{
    $_SESSION['email'] = $emailclean;
}

if (empty($passwordclean)) {
    $errorCheckr['passwordcheck'] = 'Please enter your password';

}else{
    $_SESSION['password'] = $passwordclean;
}


//Sanitize

if (!empty($emailclean) && !filter_var($emailclean, FILTER_VALIDATE_EMAIL)) {
    $errorCheckr['emailvalidcheck'] = 'Your email is not valid';
}


if (strlen($email) > 50) {
    $errorCheckr['emaillengthcheck'] = 'Your email is too long';
}

if (!empty($passwordclean) && strlen($passwordclean) < 5) {
    $errorCheckr['passwordlengthcheck'] = 'Your password is too short';
}


if (empty($errorCheckr)) {


    $result = $mysqli_conn->query("SELECT * FROM user WHERE email = '$emailclean' AND password = '$passwordclean'");

    if($row = mysqli_fetch_assoc($result)){

      $finalmessager['success'] = 'You are logged in';
      $_SESSION['finalmessager']= $finalmessager;
    }else{
      $finalmessager['fail'] = 'You are not logged in';
      $_SESSION['finalmessager']= $finalmessager;
    }

    unset($_SESSION['email']);
    unset($_SESSION['password']);

    header('location:../loginform.php');



}else{      


    $_SESSION['regErrors']= $errorCheckr;

    header('location:../loginform.php');

}
}

Answer 1

首先启用错误：

<?php
error_reporting(E_ALL);
ini_set('display_errors', '1');

测试是否设置了后置变量和密码：

<?php
var_dump($_POST['password']);
var_dump($passwordclean);

几点提示：

1）为什么要在会话中保存密码？

2）你正在检查$ passwordclean的长度，因为它是用sha512进行哈希处理所以总是128个字符。

3）：

<?php
$result = $mysqli_conn->query("SELECT * FROM user WHERE email = '". mysqli_real_escape_string($mysqli_conn, $_POST['email']) ."' AND password = '". mysqli_real_escape_string($mysqli_conn, hash("sha512", $_POST['password'])) ."'");

PHP SELECT语句不起作用

1 个答案: