的index.php

Question

我正在研究一个简单的注册系统，经过数小时的研究后仍然停滞不前。

如果我的数据库是清除的（我删除了表中的任何行），并且我提交了表单，它会发送一封验证电子邮件并激活并允许我登录。

如果我尝试使用相同的电子邮件创建另一个帐户，我没有收到我应该的错误消息，告诉用户“电子邮件已经注册”。即使我在创建第一行后使用新的电子邮件地址，它也只会将我带到一个空白页面。

当我查看我的表时，表单创建的行（第一次）具有auto-inc ID，这是正确的，用户名输入到行中，但密码，电子邮件和激活都说'0 ”。

任何人都可以在我的代码中看到错误的位置吗？我需要代码来验证输入的电子邮件是否尚未使用，如果是，则显示错误消息。如果不是，则应该在表中创建一个包含信息的新行。

我知道我需要哈希密码。我正在尝试在继续安全之前获取表中的信息。

的index.php

<?php

    include 'sessions.php';

    if(isset($_SESSION['errormessage'])){   
        echo ($_SESSION['errormessage']);
        unset ($_SESSION['errormessage']);
    }
?>

<html>
<head>
  <title>Registration Form</title>
</head>

<body>
  <form name="newForm" method="post" action="createaccount.php">UserName:
    <input type="text" name="newUserName" size="15" maxlength="15">
    <br>Password:
    <input type="password" name="newPass1" size="15">
    <br>Confirm Password:
    <input type="password" name="newPass2" size="15">
    <br>Email:
    <input type="email" name="newEmail" size="15">
    <br>
          <input type="submit" name="newSubmit">
          <input type="reset" name="newReset">
        </p>
  </form>

 <hr>

    <form name="newForm" method="post" action="login.php">
        <strong>Already Registered? Login Here:</strong>
        <br>
    UserName:
    <input type="text" name="UserName" size="15" maxlength="15">
    <br>Password:
    <input type="password" name="Pass1" size="15">
    <br>        
        <input type=submit name=SubmitButton value=Submit>
        <input type=reset name=ResetButton value=Clear>
    </form>     

</body>

</html>

createaccount.php

<?php

    include ('sessions.php');
    include ('database_connection.php');

//function to test password
function passwordStrength($pwd) {
    //test for at least 8 characters
    if (strlen($pwd) < 8) {
        return false;
    }
    //test for max length
    if (strlen($pwd) > 16) {
        return false;
    } 
    //test to see if password contains number
    if(!preg_match("#[0-9]+#", $pwd)) {
        return false;
    }
    //test to see if password has capital letter
    if(!preg_match("#[A-Z]+#", $pwd)) {
        return false;
    }
    //test to see if password has a lowercase letter
    if(!preg_match("#[a-z]+#", $pwd)) {
        return false;
    }
    //test to see if password has special character
    if(!preg_match("#[^0-9A-Za-z]#", $pwd)) {
        return false;
    }
    //test to see if password contains a space
    if (strpos($pwd, ' ') > 0) {
        return false;
    }
    else {
        return true;
    }

    return true;
}

    if(isset($_POST['newSubmit'])){
            if(empty($_POST['newUserName'])) {
            $_SESSION['errormessage'] = "Please enter a username!";
            header("Location: index.php");
            } 
            else if (strlen($_POST['newUserName']) < 4) {
                $_SESSION['errormessage'] = "Username is too short!";
                header("Location: index.php");
            } else if(strlen($_POST['newUserName']) > 16) {
                $_SESSION['errormessage'] = "Username is too long!";
                header("Location: index.php");
            } else if(empty($_POST['newPass1'])) {
                $_SESSION['errormessage'] = "You must enter a password!";
                header("Location: index.php");
            } else if(empty($_POST['newPass2'])) {
                $_SESSION['errormessage'] = "You must confirm your password!";
                header("Location: index.php");
            } else if($_POST['newPass1'] !== $_POST['newPass2']) {
                $_SESSION['errormessage'] = "Passwords do not match!";
                header("Location: index.php");
            } else if(!passwordStrength($_POST['newPass1'])) {
                $_SESSION['errormessage'] = "Password does not meet requirements!";
                header("Location: index.php");
            } else if(empty($_POST['newEmail'])) {
                $_SESSION['errormessage'] = "Must enter an email address!";
                header("Location: index.php");
            }   else {
                $Email = $_POST['newEmail'];
                $name = $_POST['newUserName'];
                $Password = $_POST['newPass1'];
                //echo "All fields accepted!";
                //$pwd = $_POST['newPass1'];
                //echo hash("sha256", $pwd);
                // Make sure the email address is available:
                $query_verify_email = "SELECT * FROM userDB WHERE email ='$Email'";
                $result_verify_email = mysqli_query($db, $query_verify_email);
                if (!$result_verify_email) {//if the Query Failed ,similar to if($result_verify_email==false)
                    $_SESSION['errormessage'] = "Sorry, that email address has already been registered!<br />If you already have an account, login below.<br /><br />";
                    header("Location: index.php");
                }

                if (mysqli_num_rows($result_verify_email) == 0) { // IF no previous user is using this email .


                    // Create a unique  activation code:
                    $activation = md5(uniqid(rand(), true));


                    $query_insert_user = "INSERT INTO `userDB` ( `username`, `email`, `password`, `activation`) VALUES ( '$name', '$Email', '$Password', '$activation')";


                    $result_insert_user = mysqli_query($db, $query_insert_user);
                if (!$result_insert_user) {
                    echo 'Query Failed ';
                }

                if (mysqli_affected_rows($db) == 1) { //If the Insert Query was successfull.
                    //send the email
                    $to = $_POST['newEmail']; // this is your Email address
                    $from = "mtshort87@gmail.com"; // this is the sender's Email address
                    $subject = "Account Succesfully Created";
                    $message = "Thank you for creating an account. Please activate it now using the link below!";
                    $message2 = "http://cts.gruv.org/short/form/activate.php?username=".$_POST['newUserName']."\n";
                    $headers = "From:" . $from;
                    $headers2 = "From:" . $to;
                    mail($to,$subject,$message2,$message,$headers);
                    mail($from,$subject,$message2,$message,$headers); // sends a copy of the message to the sender
                        $_SESSION['errormessage'] = "A confirmation e-mail has been sent to you. Please activate your account to login.";
                        header("Location: index.php");
                }
                mysqli_close($db);//Close the DB Connection
            }
        }
    }

activate.php

<?php

include 'sessions.php';
include 'database_connection.php';

if (isset($_GET['Email']) && preg_match('/^([a-zA-Z0-9])+([a-zA-Z0-9\._-])*@([a-zA-Z0-9_-])+([a-zA-Z0-9\._-]+)+$/', $_GET['Email']))
{
    $email = $_GET['Email'];
}
if (isset($_GET['key']) && (strlen($_GET['key']) == 32))//The Activation key will always be 32 since it is MD5 Hash
{
    $key = $_GET['key'];
}


if (isset($Email) && isset($key))
{
    // Update the database to set the "activation" field to null

    $query_activate_account = "UPDATE userDB SET activation=NULL WHERE(email ='$Email' AND activation='$key')LIMIT 1";


    $result_activate_account = mysqli_query($db, $query_activate_account) ;

    // Print a customized message:
    if (mysqli_affected_rows($db) == 1)//if update query was successfull
    {
    echo '<div class="success">Your account is now active. You may now <a href="login.php">Log in</a></div>';

    } else
    {
        echo '<div class="errormsgbox">Oops !Your account could not be activated. Please recheck the link or contact the system administrator.</div>';

    }

    mysqli_close($db);

} else {
        echo '<div class="errormsgbox">Error Occured .</div>';
}


?>

如果要求更多信息，我将编辑此帖子。

Answer 1

 $query_verify_email = "SELECT * FROM userDB WHERE email ='$Email'";
 $result_verify_email = mysqli_query($db, $query_verify_email);
 if (!$result_verify_email) {//if the Query Failed ,similar to if($result_verify_email==false)
      $_SESSION['errormessage'] = "Sorry, that email address has already been registered!<br />If you already have an account, login below.<br /><br />";
      header("Location: index.php");
 }

http://php.net/manual/en/mysqli.query.php

失败时返回FALSE。 成功进行SELECT，SHOW，DESCRIBE或 EXPLAIN查询mysqli_query（）将返回一个mysqli_result对象。对于其他成功的查询mysqli_query（）将返回TRUE。

由于您使用的是正确的SQL select语句，mysqli_query将返回mysqli_result个对象。

num_rows中有mysqli_result个属性，表示找到的行数。您可以使用它来检查是否有该电子邮件的记录当您期望得到1个结果时，请始终使用LIMIT 1。

FIX：

$query_verify_email = "SELECT * FROM userDB WHERE email ='$Email' LIMIT 1";
$result_verify_email = mysqli_query($mysqli, $query_verify_email);

if (is_object($result_verify_email) && $result_verify_email->num_rows > 0) {
    echo "Email already exists";
}

PHP表单只提交一行

的index.php

createaccount.php

activate.php

1 个答案: