Question

我正在为网站创建一个登录表单，该表单应该在用户登录后将用户重定向到索引页面。我遇到的问题是，当我输入登录详细信息时，它将运行错误信息的一部分。代码，我似乎无法弄清楚哪里出了问题。我遍历了我的代码，甚至在物理上比较了密码和用户名，它们是否匹配。请帮助我解决我的问题。

config.php

<?php
session_start();

$host = 'localhost';
$host_user = 'root';
$host_pass = '';
$db_name = 'the_dms_db';

$conn = mysqli_connect($host, $host_user, $host_pass, $db_name);

if (!$conn) {
    echo 'Could not connect to the database';
}

$name = '';
$surname = '';
$username = '';
$email = '';
$errors = array();

if (isset($_POST['register_user'])) {
    // receive inputs
    $name = mysqli_real_escape_string($conn, $_POST['name']);
    $surname = mysqli_real_escape_string($conn, $_POST['surname']);
    $username = mysqli_real_escape_string($conn, $_POST['username']);
    $email = mysqli_real_escape_string($conn, $_POST['email']);
    $password = mysqli_real_escape_string($conn, $_POST['password']);
    $c_password = mysqli_real_escape_string($conn, $_POST['c_password']);

    // form validation that it is filled correctly
    if (empty($name)) {
        array_push($errors, "Name is required");
    }
    if (empty($surname)) {
        array_push($errors, "Surname is required");
    }
    if (empty($username)) {
        array_push($errors, "Username is required");
    }
    if (empty($email)) {
        array_push($errors, "Email is required");
    }
    if (empty($password)) {
        array_push($errors, "Password is required");
    }
    if ($password != $c_password) {
        array_push($errors, "Passwords to not match");
    }

    // check database to see if user exists
    $user_check_query = "SELECT * FROM users WHERE username='$username' OR email = '$email' LIMIT 1";
    $result = mysqli_query($conn, $user_check_query);
    $user = mysqli_fetch_assoc($result);

    if ($user) {
        if ($user['username'] === $username) {
            array_push($errors, 'Username already exists');
        }

        if ($user['email'] === $email) {
            array_push($errors, 'Email already exists');
        }
    }

    // register user if no errors
    $pass_hash = password_hash($password, PASSWORD_BCRYPT);
    if (count($errors) == 0) {

        $query = "INSERT INTO users (name, surname, username, email, password) VALUES ('$name', '$surname', '$username', '$email', '$pass_hash')";
        mysqli_query($conn, $query);
        $_SESSION['username'] = $username;
        $_SESSION['success'] = 'You are now logged in!';
        header('location: ./index.php');
    }
}

if (isset($_POST['login_user'])) {
    $username = mysqli_real_escape_string($conn, $_POST['username']);
    $password = mysqli_real_escape_string($conn, $_POST['password']);

    if (empty($username)) {
        array_push($errors, 'Username is required');
    }
    if (empty($password)) {
        array_push($errors, 'Password is required');
    }

    if (count($errors) == 0) {
        $password = password_hash($password, PASSWORD_BCRYPT);

        $query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
        $results = mysqli_query($conn, $query);

        if (mysqli_num_rows($results) == 0) {
            $_SESSION['username'] = $username;
            $_SESSION['success'] = 'You are now logged in!';
            header('location: ./index.php');
        } else {
            array_push($errors, 'Wrong username/password');
        }
    }
}

signin.php

<?php
require_once './header.php';
include_once './config.php';
?>
<link rel="stylesheet" href="/assets/css/style.css">
<section class="sign-in-section">
    <div class="container">
        <div class="form-area ">
            <h1>Sign In</h1>
            <form action="./signin.php" class="signin-form" method="POST">
                <?php include './errors.php'; ?>
                <section class="input-sections">
                    <input type="text" class="inputs form-control" name="username" id="username" placeholder="Username or Email">
                    <input type="password" class="inputs form-control" name="password" id="password" placeholder="Password">
                    <button type="submit" class="btn-form btn signin-btn" name="login_user" id="login_user">Sign in</button>
                </section>
            </form>
            <a href="./signup.php">Not yet a member? Register here!</a>
        </div>
    </div>
</section>

signup.php

<?php
include './config.php';
require_once './header.php';
?>
<link rel="stylesheet" href="/assets/css/style.css">
<section class="sign-in-section">
    <div class="container">
        <div class="form-area ">
            <h1>Sign up</h1>
            <form action="signup.php" class="signup-form" method="post">
                <?php include './errors.php' ?>
                <section class="input-sections">
                    <input type="text" class="inputs form-control" name="name" id="name" placeholder="Name" value="<?php echo $name ?>">
                    <input type="text" class="inputs form-control" name="surname" id="surname" placeholder="Surname" value="<?php echo $surname ?>">
                    <input type="text" class="inputs form-control" name="username" id="username" placeholder="Username" value="<?php echo $username ?>">
                    <input type="text" class="inputs form-control" name="email" id="email" placeholder="Email" value="<?php echo $email ?>">
                    <input type="password" class="inputs form-control" name="password" id="password" placeholder="Password">
                    <input type="password" class="inputs form-control" name="c_password" id="c_password" placeholder="Confirm Password">
                    <button type="submit" class="btn-form btn register-btn" name="register_user" id="register">Register</button>
                </section>
            </form>
            <a href="./signin.php">Already have an account? Sing in here!</a>
        </div>
    </div>
</section>

errors.php

<?php if (count($errors) > 0) : ?>
    <div class="error">
        <?php foreach ($errors as $error) : ?>
            <p><?php echo $error ?></p>
        <?php endforeach ?>
    </div>
<?php endif ?>

Answer 1

如果匹配，返回的结果应该不是1行而不是0行？

更改此

if (mysqli_num_rows($results) == 0)

对此

if (mysqli_num_rows($results) >= 1)

Answer 2

如果您忽略sql语句中的漏洞，则应分析以下内容，以查看您对上述方法的误解。使用password_hash将在每次调用时生成一个新的哈希-因此，哈希密码将永远不会（希望）与新生成的哈希匹配。您需要改用password_verify。

define('BR','<br />');
$password=$_POST['password'];

$query = "SELECT `password` FROM `users` WHERE `username`='$username' LIMIT 1";
$results = mysqli_query( $conn, $query );

$rs=mysqli_fetch_assoc( $results );

if( password_verify( $password, $rs['password'] ) ){
    /* OK - The user supplied a good username/password combo */
}else{
    /* Bad Foo!!! The supplied password did not verify against the stored hash */
}

如果您考虑

$pwd='banana';
echo password_hash($pwd,PASSWORD_DEFAULT) . BR;
echo password_hash($pwd,PASSWORD_DEFAULT) . BR;
echo password_hash($pwd,PASSWORD_DEFAULT) . BR;

您可能会看到类似以下结果：

$2y$10$7a4Cvzn51eYa3EJKary8zemJn4/GiFA.2fqYQrwd6QrRORIk552Wm
$2y$10$E5.28SSkQo2lZv11zilkBO1L35umAFzr5Zr2yKScX4nDgFkN.kTbK
$2y$10$HEzHOFT/7V972XDEB9uzRuU/dxHxRnSXs64wu1qdahJs2CSp3wwD6

如您所见，它们都是不同的...

输入详细信息后，登录表单无法登录

2 个答案: