Question

所以我正在尝试创建一个简单的登录结构，我不知道为什么它不起作用，我很欣赏这里有很多例子，请不要将其标记为重复，我真的需要一些帮助我有尝试过，但我看不出我做错了什么。

<?php

session_start();
include 'databaseconnection.php';

$email = strip_tags($_POST['email']);
$pwd = strip_tags($_POST['pwd']);

$sql = "SELECT * FROM user WHERE email='$email'";
$result = mysqli_query($conn, $sql);
$row = mysqli_fetch_assoc($result);
$hash_pwd = $row['pwd'];
$hash = password_verify($pwd, $hash_pwd);

if ($hash == 0) {
  header("Location: error.php")
  exit();
} else {

$sql = "SELECT * FROM user WHERE email='$uid' AND pwd ='$hash_pwd'";
$result = mysqli_query($conn, $sql);

if (!row = mysqli_fetch_assoc($result)); {
  echo "your email address or password is incorrect!";
} else {
  $_SESSION['id'] = $row['id'];
}

header("Location: profile.php")

如果有人可以简单地建议我应该做出哪些改变，我会非常感激。

Answer 1

首先检查请求第二个过滤器输入第三个使用pdo

   <?php
    session_start();
    include 'databaseconnection.php';
    if ($_SERVER['REQUEST_METHOD'] == 'POST'){
    $email = filter_input(INPUT_POST, 'email',FILTER_VALIDATE_EMAILL); //filter input
    $pwd = filter_input(INPUT_POST, 'pwd',FILTER_SANITIZE_STRING,FILTER_FLAG_STRIP_HIGH); //filter input
    $hashed = sha1($pwd);

    $sql= $conn->prepare( "SELECT * FROM user WHERE email ? AND password = ?"); //use pdo here
    $sql->execute(array($email, $pwd));
    $row = $sql->fetch();

    if($row['email'] !== $email || $row['password'] !== $hashed){

      header("Location: error.php");
      exit();
    } else {

      $_SESSION['id'] = $row['id'];
      header("Location: profile.php");
    }
    }else {
      echo 'error';
    }
?>

Answer 2

你去了简单的代码

<?php

session_start();
include 'databaseconnection.php';

$email = $_POST['email'];
$pwd = $_POST['pwd'];

$sql = "SELECT * FROM user WHERE email = '$email'";
$result = mysqli_query($conn, $sql);
$row = mysqli_fetch_assoc($result);
$hash_pwd = $row['pwd']; // password from database

// if password is valid start session and redirect to profile.php
if (password_verify($pwd, $hash_pwd))
{
    $_SESSION['id'] = $row['id'];
    header('Location: profile.php');
}
else
{
    header("Location: error.php")
    exit();
}

?>

Answer 3

您尚未关闭“} else {”...部分。

PHP使用散列密码问题登录页面

3 个答案: