Question

很抱歉，但是我再次为那些可以花一点时间帮助一个陷入困境的菜鸟的人发了一篇长篇文章。

我遇到了一些困难，之前在这里询问过如何从数据库中抽取任何用户名和姓的任何指导，只有在登录时才会输入用户名和密码。

现在编辑我的代码时，似乎任何人都可以随意登录。

Login.php脚本如下：

<?php
session_start();

require_once 'classes/membership.php';
$membership = new Membership();

// If the user clicks the "Log Out" link on the index page.
if(isset($_GET['status']) && $_GET['status'] == 'loggedout') {
    $membership->log_User_Out();
}

// Did the user enter a password/username and click submit?
if($_POST && !empty($_POST['username']) && !empty($_POST['pwd'])) {
    $response = $membership->validate_User($_POST['username'], $_POST['pwd']);
}
?>

这首先指向Membership.php：

<?php

require 'mysql.php';

class Membership {

function validate_user($un, $pwd) {
    $mysql = New Mysql();
    $ensure_credentials = $mysql->verify_Username_and_Pass($un, md5($pwd));

    list($ensureCredentials, $data) = $mysql->verify_Username_and_Pass($un, md5($pwd));
if($ensure_credentials) {
    $_SESSION['status'] = 'authorized';
    $_SESSION['fname'] = $data['fname'];
    $_SESSION['lname'] = $data['lname'];
    header("location: medlem.php");
} else return "Please enter correct username and password";

} 

function log_User_Out() {
    if(isset($_SESSION['status'])) {
        unset($_SESSION['status']);

        if(isset($_COOKIE[session_name()])) 
            setcookie(session_name(), '', time() - 1000);
            session_destroy();
    }
}
function confirm_Member() {
    session_start();
    if($_SESSION['status'] !='authorized') header("location: login.php");
}
}

然后又指向mysql.php：

<?php

require_once 'includes/constants.php';

class Mysql {
private $conn;

function __construct() {
    $this->conn = new mysqli(DB_SERVER, DB_USER, DB_PASSWORD, DB_NAME) or 
                  die('There was a problem connecting to the database.');
}

function verify_Username_and_Pass($un, $pwd) {

$query = "SELECT *
        FROM users
        WHERE username = ? AND password = ?
        LIMIT 1";

if($stmt = $this->conn->prepare($query)) {
    $stmt->bind_param('ss', $un, $pwd);
    $stmt->execute();
    // UPDATE : I added correct usage of the stmt here.    
    $result = $stmt->get_result();
    if($row = $result->fetch_array()) {
       $stmt->free_result();
       $stmt->close();                
        // returning an array the first item is the validation the second is the data. 
        return array(true, $row);
    }
}
// if there is no just return empty data, and false for validation.
return array(false, array());
}
}

为了重复使用，我在这个项目中使用了常量：

<?php

// Define constants here

define('DB_SERVER', 'localhost');
define('DB_USER', 'myusername');
define('DB_PASSWORD', 'mypassword');
define('DB_NAME', 'sameige_membership');

使用此当前脚本集，它将使用我在用户名和密码字段中设置的任何内容登录。网页也应该发布名字和姓氏，以告诉用户他是谁以及是否已登录由$ _SESSION发布（＆＃39; fname / lname＆＃39;）。

当我恢复到开头的状态时，登录工作正常。在添加到查询部分以从DB中绘制第一个和最后一个名称之前。

这是原始的：

<?php

require_once 'includes/constants.php';

class Mysql {
private $conn;

function __construct() {
    $this->conn = new mysqli(DB_SERVER, DB_USER, DB_PASSWORD, DB_NAME) or 
                  die('There was a problem connecting to the database.');
}

function verify_Username_and_Pass($un, $pwd) {

    $query = "SELECT *
            FROM users
            WHERE username = ? AND password = ?
            LIMIT 1";

    if($stmt = $this->conn->prepare($query)) {
        $stmt->bind_param('ss', $un, $pwd);
        $stmt->execute();

        if($stmt->fetch()) {
            $stmt->close();
            return true;
        }
    }
    }
}

根据我的理解，此scirpt应将$ _POST [＆＃39;用户名＆＃39;] / [＆＃39;密码＆＃39;]与数据库中选定的用户名和密码字段进行比较。如果它们是正确的，它应该返回登录并重定向到medlem.php页面。如果是，则应返回以输入正确的用户名和密码。

然而，这会登录并重定向。

任何对我正在做的事情的回答都会受到极大的关注，因为我是这个主题的全部菜鸟。

问候，乔希

Answer 1

首先，关于检查用户输入的代码是错误的...您应该像检查if isset($_POST['username'] && isset($_POST['password'])而不是if($_POST)一样检查。

第二个你说：$response = $membership->validate_User($_POST['username'], $_POST['pwd']);你的班级是：validate_user ....这是区分大小写的（如果可以，请使用Dreamweaver，它会警告你这些错误）

3解决它们并再次检查。

Answer 2

<?php
session_start();

require_once 'classes/membership.php';
$membership = new Membership();

// If the user clicks the "Log Out" link on the index page.
if(isset($_GET['status']) && $_GET['status'] == 'loggedout') {
    $membership->log_User_Out();
}

// Did the user enter a password/username and click submit?

使用isset（$ _ POST ['submit']）代替$ _POST并且note方法区分大小写。所以它将是validate_user而不是validate_User

if(isset($_POST['submit']) && !empty($_POST['username']) && !empty($_POST['pwd'])) {
    $response = $membership->validate_user($_POST['username'], $_POST['pwd']);
}
?>

现在在你的mysql.php中，我会这样做：

<?php

require_once 'includes/constants.php';

class Mysql {
private $conn;

function __construct() {
    $this->conn = new mysqli(DB_SERVER, DB_USER, DB_PASSWORD, DB_NAME) or 
                  die('There was a problem connecting to the database.');
}

function verify_Username_and_Pass($un, $pwd) {

$query = "SELECT *
        FROM users
        WHERE username = ? AND password = ?
        LIMIT 1";

if($stmt = $this->conn->prepare($query)) {
$stmt->bind_param('ss', $un, $pwd);
$stmt->execute();
// UPDATE : I added correct usage of the stmt here.    
$result = $stmt->get_result();
if($row = $result->fetch_assoc()) {
   $stmt->free_result();
   $stmt->close();                       
        // returning an array the first item is the validation the second is the data. 

     $result['data']=$row;
     $result['validation']=true;

        return $result;

    }
}
// if there is no just return empty data, and false for validation.
$result['data']=array();
$result['validation']=false;
return $result;
}
}

现在，我将在Membership.php中进行以下更改

function validate_user($un, $pwd) {
    $mysql = New Mysql();
    $ensure_credentials = $mysql->verify_Username_and_Pass($un, md5($pwd));
    $data=$ensure_credentials['data'];
    $validation=$ensure_credentials['validation'];

if($validation) {
    $_SESSION['status'] = 'authorized';
    $_SESSION['fname'] = $data['fname'];
    $_SESSION['lname'] = $data['lname'];
    header("location: medlem.php");
} else return "Please enter correct username and password";

希望这对你有用....：）

使用用户名和密码字段输入的脚本登录

2 个答案: