Question

我试图找到如何检查一个名为active的变量是否等于1.我对该函数的尝试如下：

function login($email, $password, $mysqli) {
    // Using prepared statements means that SQL injection is not possible. 
    if ($stmt = $mysqli->prepare("SELECT id, username, password, salt, active 
                  FROM members 
                                  WHERE email = ? LIMIT 1")) {
        $stmt->bind_param('s', $email);  // Bind "$email" to parameter.
        $stmt->execute();    // Execute the prepared query.
        $stmt->store_result();

        // get variables from result.
        $stmt->bind_result($user_id, $username, $db_password, $salt, $active);
        $stmt->fetch();

        // hash the password with the unique salt.
        $password = hash('sha512', $password . $salt);
        if ($stmt->num_rows == 1) {

            // If the user exists we check if the account is locked
            // from too many login attempts 
            if (checkbrute($user_id, $mysqli) == true) {
                // Account is locked 
                // Send an email to user saying their account is locked 
                return false;
            } else {
                // Check if the password in the database matches 
                // the password the user submitted.
                if ($db_password == $password) {
                    // Password is correct!
                    // Get the user-agent string of the user.
                    $user_browser = $_SERVER['HTTP_USER_AGENT'];

                    // XSS protection as we might print this value
                    $user_id = preg_replace("/[^0-9]+/", "", $user_id);
                    $_SESSION['user_id'] = $user_id;

                    // XSS protection as we might print this value
                    $username = preg_replace("/[^a-zA-Z0-9_\-]+/", "", $username);

                    $_SESSION['username'] = $username;
                    $_SESSION['login_string'] = hash('sha512', $password . $user_browser);
                } else {
                    // Password is not correct 
                    // We record this attempt in the database 
                    $now = time();
                    if (!$mysqli->query("INSERT INTO login_attempts(user_id, time) 
                                    VALUES ('$user_id', '$now')")) {
                        header("Location: ../error?err=Database error: login_attempts");
                        exit();
                    }

                    return false;
                }
            }
        } else {
            // No user exists. 
            return false;
        }
    } else {
        // Could not create a prepared statement
        header("Location: ../error?err=Database error: cannot prepare statement");
        exit();
    }
}

我假设我在$ mysqli-＆gt; prepare语句中添加了active是正确的。我想要做的是如果用户的密码正确，我会查询MySQL表以查看他的帐户是否有效（1）或未激活（0）。如果设置为0，则登录时没有错误。但是在我的process_login.php文件中，如果用户是（0）但是使用index.php？err = 1

，则会记录用户

<?php

include_once 'db_connect.php';
include_once 'functions.php';

sec_session_start(); // Our custom secure way of starting a PHP session.

if (isset($_POST['email'], $_POST['p'])) {
    $email = filter_input(INPUT_POST, 'email', FILTER_SANITIZE_EMAIL);
    $password = $_POST['p']; // The hashed password.

    if (login($email, $password, $mysqli) == true) {

        // Login success 
        header("Location: ../protected_page.php");

        exit();
    } else {
        // Login failed 
        header('Location: ../index.php?error=1');
        echo $active;
        exit();
    }
} else {
    // The correct POST variables were not sent to this page. 
    header('Location: ../error.php?err=Could not process login');
    exit();
}

当我尝试回显变量$ active时，它什么都不返回。提前感谢任何帮助。

Answer 1

将此信息发布为社区维基;我不想要代表它，也不应该有它。

答：您没有完全像编写本教程那样遵循该教程。

http://www.wikihow.com/Create-a-Secure-Login-Script-in-PHP-and-MySQL

因为很明显这就是代码来自的地方;我知道这一切都很好。

你修改了代码的某些部分并留下了一些代码。

返回教程，并按照“到T ”进行操作。您可能还需要清除现有的哈希并重新开始。

确保表格创建完全如图所示。如果你没有制作正确的列和正确的长度，那么“默默地”就会失败。

请参阅我在问题下留下的评论。

MySQL Query很好，没有给出值或错误

1 个答案: