Question

我坚持一个项目。这严格适用于公司内部员工登录页面。不公开！对于那些可能质疑这种形式的安全性的人。虽然，我愿意哈希密码密码（SHA-1）。

我已经在我的jsfiddle PINCODE LOGIN

上设置了代码

<body onLoad="emptyCode()" class="hold-transaction login-page">
    <!-- Page Content -->
  <div class="login-box">
<div class="login-logo">
  <a href="login.php"><b>PINCODE LOGIN</b></a>
  <p class="login-box-msg">Employee Sign-in</p>
</div>
<!-- /.login-logo -->
<div class="login-box-body">
  <!--<form action="" method="post">-->
  <div class="main_panel">
    <form action="" method="post">
      <div class="input-group">
        <input type="text" name="code" maxlength="4" readonly="readonly" class="form-control" placeholder="Enter PIN...">
        <span class="input-group-btn">
                <button class="btn btn-danger" type="reset" >X</button>
            </span>
      </div>
      <!-- /input-group -->

      <table id="keypad" cellpadding="5" cellspacing="3">
        <tbody>
          <tr>
            <td onclick="addCode('1');">
              <div class="button raised clickable">
                <input type="checkbox" class="toggle" />
                <div class="anim"></div><span>1</span>
              </div>
            </td>
            <td onclick="addCode('2');">
              <div class="button raised clickable">
                <input type="checkbox" class="toggle" />
                <div class="anim"></div><span>2</span>
              </div>
            </td>
            <td onclick="addCode('3');">
              <div class="button raised clickable">
                <input type="checkbox" class="toggle" />
                <div class="anim"></div><span>3</span>
              </div>
            </td>
          </tr>
          <tr>
            <td onclick="addCode('4');">
              <div class="button raised clickable">
                <input type="checkbox" class="toggle" />
                <div class="anim"></div><span>4</span>
              </div>
            </td>
            <td onclick="addCode('5');">
              <div class="button raised clickable">
                <input type="checkbox" class="toggle" />
                <div class="anim"></div><span>5</span>
              </div>
            </td>
            <td onclick="addCode('6');">
              <div class="button raised clickable">
                <input type="checkbox" class="toggle" />
                <div class="anim"></div><span>6</span>
              </div>
            </td>
          </tr>
          <tr>
            <td onclick="addCode('7');">
              <div class="button raised clickable">
                <input type="checkbox" class="toggle" />
                <div class="anim"></div><span>7</span>
              </div>
            </td>
            <td onclick="addCode('8');">
              <div class="button raised clickable">
                <input type="checkbox" class="toggle" />
                <div class="anim"></div><span>8</span>
              </div>
            </td>
            <td onclick="addCode('9');">
              <div class="button raised clickable">
                <input type="checkbox" class="toggle" />
                <div class="anim"></div><span>9</span>
              </div>
            </td>
          </tr>
          <tr>
            <td>
            </td>
            <td onclick="addCode('0');">
              <div class="button raised clickable">
                <input type="checkbox" class="toggle" />
                <div class="anim"></div><span>0</span>
              </div>
            </td>
          </tr>
        </tbody>
      </table>

      <p id="message">ACCESSIGN...</p>
    </form>
  </div>
  <!--</form>-->
  </div>
  <!-- /.login-box-body -->
    </div>
  <!-- /.login-box --> 
</body>

我的目标是：

允许员工使用4位密码登录并验证针对数据库凭据
BONUS：数据库中的哈希密码

不确定我是否需要一个函数，例如“if（isset（$ _ POST ['code']））{”，作为一个单独的文件。

Answer 1

首先，您关闭表单末尾的表单标记，这意味着几乎整个页面都会回发到您的服务器。你可以缩小这个：

<form action="secret.php" method="post">
<input name="code">
</form>

现在它被发布到＆＃34; secret.php＆＃34;在action标记中指定。这看起来像这样：

Secret.php:
<?php
if(isset($_POST["code"])){
if($_POST["code"]=="5473")){
echo "successfully logged in...";
$_SESSION["logged"]=true;
}else{
echo " wrong code";
}
}else{
echo "404: this is not accessible for you";
}
?>

这将检查代码是否已发布以及代码是否已发布5473.如果代码正确，则会设置会话以帮助您识别用户。只需：

<?php
if(isset($_SESSION["logged"])){
echo " logged in user...";
}else{
echo "not for you.please log in";
die();
}
?>

Answer 2

我更新了我的代码。这个功能似乎很棒！

function loginEmployee() {
global $connection;
$pincode = $_POST["code"];

if(isset($_POST["code"])){
$result = mysqli_query($connection,"SELECT * FROM users WHERE user_pin = '$pincode'");
if(mysqli_num_rows($result) != 0) {
echo "<p class='alert-successs'>successfully logged in...</p>";
header("Location: ../repairs.php");
die();
$_SESSION["logged"]=true;
}else{
header("Location: ../login_fail.php");
die();
}
}else{
echo "404: this is not accessible for you";
}

PINCODE登录页面

2 个答案: