Question

我正在努力让登录代码成功运行。它不断响应＆＃34;用户名或密码错误。＆＃34;部分，虽然输入了正确的用户名和密码。我错过了什么地方，请帮忙。

    <?php
//Check login details
    session_start();
    //get user input from the form
    if (isset($_POST['Submit'])) {
        $username = checkData($_POST['username']);
        $password = checkData($_POST['password']);

        require ('config.php'); //database connection
        global $dbselect;

        $qry = 'SELECT username, password
                FROM users
                WHERE username = :username AND password = :password
                LIMIT 1';
        $statement = $dbselect->prepare($qry);
        $statement->bindValue(':username', $username);
        $statement->bindValue(':password', $password);
        $statement->execute();
        $login = $statement->fetch(PDO::FETCH_ASSOC);
        if (count($login) > 0 && password_verify($password, $login['password'])) {
            $_SESSION['username'] = $login['username'];
            header('location:home.html');
        } else {
            echo "Username or Password incorrect. Please try again.";
        }       
        $statement->closeCursor();
    }

    //validate data 
    function checkData($data) {
        $data = trim($data);
        $data = stripslashes($data);
        $data = htmlspecialchars($data);
        return $data;
    }
?>

Answer 1

以下工作在测试中（直到password_verify，我使用了不同的测试，因为我有PHP 5.3.2，因此没有password_verify）〜希望它可能证明是有益的。

<?php
    session_start();

    /* error messages used to display to user */
    $ex=array(
        0   =>  'One or more required POST variables are not set',
        1   =>  'Both username & password are required',
        2   =>  'Failed to prepare SQL query',
        3   =>  'Query failed',
        4   =>  'No results',
        5   =>  'Invalid login details'
    );

    if( $_SERVER['REQUEST_METHOD']=='POST' ){
        try{
            if( isset( $_POST['Submit'], $_POST['username'], $_POST['password'] ) ) {

                $username = !empty( $_POST['username'] ) ? filter_input( INPUT_POST, 'username', FILTER_SANITIZE_STRING ) : false;
                $password = !empty( $_POST['password'] ) ? filter_input( INPUT_POST, 'password', FILTER_SANITIZE_STRING ) : false;

                if( $username && $password ){

                    require('config.php');
                    global $dbselect;/* ??? */

                    /* use the username in the sql not password & username */
                    $sql='select `username`, `password`
                            from `users`
                            where `username` = :username';
                    $stmt=$dbselect->prepare( $sql );

                    /* only proceed if prepared statement succeeded */
                    if( $stmt ){
                        $stmt->bindParam( ':username', $username );
                        $status=$stmt->execute();

                        if( !$status )throw new Exception('',3);

                        $rows=$stmt->rowCount();
                        if( !$rows > 0 )throw new Exception('',4);

                        $result = $stmt->fetchObject();
                        $stmt->closeCursor();


                        /* password_verify is available from PHP 5.5 onwards ~ I have 5.3.2 :( */
                        if( $result && function_exists('password_verify') && password_verify( $password, $result->password ) ){
                            /* valid */
                             $_SESSION['username']=$username;
                             exit( header('Location: home.html') );
                        } else {
                            /* bogus - invalid credentials */
                            throw new Exception('',5);
                        }
                    } else {
                        /* sql prepared statement failed */
                        throw new Exception('',2);
                    }
                } else {
                    /* either username or password was empty */
                    throw new Exception('',1);
                }
            } else {
                /* one or more POST variables are not set */
                throw new Exception('',0);
            }
        }catch( Exception $e ){

            /* set a session variable to ensure error message is displayed only once */
            $_SESSION['error']=$ex[ $e->getCode() ];

            /* reload the login page with error code */
            exit( header( 'Location: ?error=' . $e->getCode() ) );
        }
    }
?>

    <!doctype html>
    <html>
        <head>
            <title>Login</title>
        </head>
        <body>
        <!-- the php/html login page -->

        <form method='post'>
            <input type='text' name='username' />
            <input type='password' name='password' />
            <input type='submit' name='Submit' value='Login' />

            <?php
                if( $_SERVER['REQUEST_METHOD']=='GET' && isset( $_GET['error'], $_SESSION['error'] ) ){

                    unset( $_SESSION['error'] );

                    /* display the error message */
                    echo "<h2 style='color:red'>{$ex[ $_GET['error'] ]}</h2>";
                }
            ?>
        </form>
        </body>
    </html>

Answer 2

/ ** *您可能需要保存密码的哈希副本 *用户创建，以便您可以针对哈希值password_verify输入密码 *从DB返回的副本。 *像这样： * $ hashed = password_hash（$ password，PASSWORD_BCRYPT）; *注意：我已经改变了你的代码，请适应。 * /

//Check login details
session_start();
//get user input from the form
if (isset($_POST['Submit'])) {
    $username   = checkData($username);
    $password   = checkData($password);

    $dbname     = "testo";
    $servername = "localhost";
    $conn       = new PDO("mysql:host=$servername;dbname=$dbname", "root", "");
    $parr       = array($username,$password); 

    $qry = 'SELECT username, password, phashed
    FROM users
    WHERE username = ? AND password = ?
    LIMIT 1';

    $stmt       = $conn->prepare($qry);
    $Qres       = $stmt->execute($parr);
    $login      = ($Qres) ? $stmt->fetchAll(PDO::FETCH_ASSOC) : array();

    if (count($login) > 0 && password_verify($password, $login[0]['phashed'])) {
        $_SESSION['username'] = $login[0]['username'];
        header('location:home.html');
    } else {
        echo "Username or Password incorrect. Please try again.";
    }       
    $conn = null;
}

//validate data 
function checkData($data) {
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    return $data;
}

PHP PDO登录代码 - 重复错误，无法登录[输入正确的用户名和密码]

2 个答案: