Question

我想创建一个有效的登录表单。这是我所做的，这个显示不能选择db。

已编辑的login.php文件

<?php
    error_reporting(E_ALL);
    //Connection Variables:
    $dbhost = "localhost";
    $dbname = "";
    $dbuser = "";
    $dbpass = "";
try{
    //Connection to SQL:
        $conn = new PDO("mysql:host=$dbhost; dbname=$dbname", $dbuser, $dbpass);
    //Error messagin enabled:
        $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

    }
    catch (PDOException $e)
    {
        echo $e->getMessage();
    }


    $user = '';
    $pass = '';
    $sum = 0;
    $error_msg = "Please type a username and a password";
    if(isset($_POST['login']))
    {
        //Start a session:
        session_start();

        $user = $_POST['email'];
        $pass = $_POST['password'];
        if(empty($user) && empty($pass))
        {
            echo $error_msg;
            $pass = '';
        }
        if(empty($user) || empty($pass))
        {
            echo $error_msg;
            $user = '';
            $pass = '';
        }
        if(!empty($user) && !empty($pass))
        {
            //SQL:
            $query = $conn->prepare("SELECT * FROM login WHERE user = :u AND password= :p LIMIT 1");
            $query->bindParam(":u", $user);
            $query->bindParam(":p", $pass);
            //Execute query:
            $query->execute();
            $number_rows = $query->fetch(PDO::FETCH_NUM);
            if($number_rows>0)
            {
                echo $user;
                $_SESSION['usern'] = $user;
                $_SESSION['passw'] = $pass;
                header("Location: ./pages/home.php");
            }
            //echo $user;
            else
            {
                echo "Invalid username or password";
                header("Location: index.html");
            }
        }
    }
    if(!isset($_POST['login']))
    {
        echo "Login button not clicked";
    }
?>

我读了越来越多关于此的文章，但仍无法找到解决方案。

编辑HTML

<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <!-- The above 3 meta tags *must* come first in the head; any other head content must come *after* these tags -->
    <meta name="description" content="">
    <meta name="author" content="">
    <link rel="icon" href="../../favicon.ico">

    <title>Signin for OTMS</title>

    <!-- Bootstrap core CSS -->
    <link href="css/bootstrap.min.css" rel="stylesheet">

    <!-- Custom styles for this template -->
    <link href="signin.css" rel="stylesheet">

    <!-- Just for debugging purposes. Don't actually copy these 2 lines! -->
    <!--[if lt IE 9]><script src="../../assets/js/ie8-responsive-file-warning.js"></script><![endif]-->
    <script src="js/ie-emulation-modes-warning.js"></script>

    <!-- HTML5 shim and Respond.js for IE8 support of HTML5 elements and media queries -->
    <!--[if lt IE 9]>
      <script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script>
      <script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
    <![endif]-->
  </head>

  <body>

    <div class="container">

      <form action="login.php" method="post" class="form-signin">
        <h2 class="form-signin-heading">Please sign in</h2>
        <label for="inputEmail" class="sr-only">Email address</label>
        <input type="email" name="email" id="inputEmail" class="form-control" placeholder="Email address" required autofocus>
        <label for="inputPassword" class="sr-only">Password</label>
        <input type="password" name="password" id="inputPassword" class="form-control" placeholder="Password" required>
        <div class="checkbox">
          <label>
            <input type="checkbox" value="remember-me"> Remember me
          </label>
        </div>
        <button class="btn btn-lg btn-primary btn-block" type="submit" name="login">Sign in</button>
      </form>

    </div> <!-- /container -->


    <!-- IE10 viewport hack for Surface/desktop Windows 8 bug -->
    <script src="assets/js/ie10-viewport-bug-workaround.js"></script>
  </body>
</html>

请帮我查一下这是什么错误。我使用phpMyAdmin创建了我的数据库，它在localhost中创建。我使用Bootstrap设计了接口。

这是我现在得到的错误：

database name- otmsdb
table name- login
email, passowrd, 
button name- login

Answer 1

先生，您的代码很容易受到SQL注入攻击。请开始使用MySQLi或PDO。这是一个用于登录的PDO代码，应该可以正常使用：资料来源：Udemy Online课程。

编辑：使用此代码，并将变量更改为您的

<?php
if(isset($_POST['login'])){
    session_start();
    $errmsg_arr = array();
    $errflag = false;
    // configuration
    $dbhost     = "localhost";
    $dbname     = "your database name";
    $dbuser     = "your username";
    $dbpass     = "your password";

    // database connection
    $conn = new PDO("mysql:host=$dbhost;dbname=$dbname",$dbuser,$dbpass);
    $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    $conn->exec("SET CHARACTER SET utf8mb4");
    // new data

    $user = $_POST['your name of email input'];
    $password = $_POST['password'];

    if($user == '') {
        $errmsg_arr[] = 'You must enter your Username';
        $errflag = true;
    }
    if($password == '') {
        $errmsg_arr[] = 'You must enter your Password';
        $errflag = true;
    }

    // query
    $result = $conn->prepare("SELECT * FROM login WHERE username= :u AND password= :p");
    $result->bindParam(':u', $user);
    $result->bindParam(':p', $password);
    $result->execute();
    $rows = $result->fetch(PDO::FETCH_NUM);
    if($rows > 0) {
        $_SESSION['username'] = $user;
        header("location: ./pages/home.php");
    }
    else{
        $errmsg_arr[] = 'Username and Password are not found';
        $errflag = true;
    }

}
?>

HTML表格：

<body>
<form action="" method="post" name="login">
<input type="text" name="username" placeholder="Enter a Username"/>
<input type="password" name="password" placeholder="***"/>
<input type="submit" name="login_submit" value="Login"/>
</form>
</body>

Answer 2

建议：

echo mysql_error()确定错误发生的原因：

mysql_select_db("$db_name") or die("cannot select DB: " . mysql_error());
停止使用已弃用的功能＆＃34; mysql_connect（）＆＃34;，＆＃34; mysql_query（）＆＃34;和朋友。相反，您可以更好地使用mysqli。
使用Prepared Statements代替构建您的＆＃34;选择＆＃34;直接来自您的POST参数。

使用php，mysql和html创建登录表单

2 个答案: