Question

我有买家表格，名为“Buyer.php”：

<form method="post" action="check_buyer.php" id="LoggingInBuyer">
    <div style="width:265px;margin:0; padding:0; float:left;">
    <label>Username:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span><a href="#">Forgot Username?</span></a></label> <br />
    <input id="UserReg" style="width:250px;" type="text" name="userName" tabindex="1" class="required" /></div>
    <div style="width:265px;margin:0; padding:0; float:right;">
    <label>Password:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span><a href="#">Forgot Password?</span></a></label> <br />
    <input id="UserReg" style="width:250px;" type="password"  name="userPass" tabindex="2" class="required" /></div>
    <div class="clearB"> </div>
    <input type="submit" style="width:100px; margin:10px 200px;" id="UserRegSubmit" name="submit" value="Login" tabindex="3" />
</form>

一个名为check_buyer.php的文件（在同一个目录中）：

<?php
session_start(); #recall session from index.php where user logged include()

function isLoggedIn()
{
    if(isset($_SESSION['valid']) && $_SESSION['valid'])
        header( 'Location: buyer/' ); # return true if sessions are made and login creds are valid
    echo "Invalid Username and/or Password";  
    return false;
}

require_once('../inc/db/dbc.php');

$connect = mysql_connect($h, $u, $p) or die ("Can't Connect to Database.");
mysql_select_db($db);

$LoginUserName = $_POST['userName'];
$LoginPassword = mysql_real_escape_string($_POST['userPass']);
//connect to the database here
$LoginUserName = mysql_real_escape_string($LoginUserName);
$query = "SELECT uID, uUPass, dynamSalt, uUserType FROM User WHERE uUName = '$LoginUserName';";

function validateUser($ifUserExists['uID'], $ifUserExists['uUserType']) {
    $_SESSION['valid'] = 1;
    $_SESSION['uID'] = $uID;
    $_SESSION['uUserType'] = $uUserType; // 1 for buyer - 2 for merchant
}

$result = mysql_query($query);
if(mysql_num_rows($result) < 1) //no such USER exists
{
    echo "Invalid Username and/or Password";
}
$ifUserExists = mysql_fetch_array($result, MYSQL_ASSOC);

$dynamSalt = $ifUserExists['dynamSalt'];  #get value of dynamSalt in query above
$SaltyPass = hash('sha512',$dynamSalt.$LoginPassword); #recreate originally created dynamic, unique pass

if($SaltyPass != $ifUserExists['uUPass']) # incorrect PASS
{
    echo "Invalid Username and/or Password";
}else {
    validateUser();
}
// If User *has not* logged in yet, keep on /login
if(!isLoggedIn())
{
    header('Location: index.php');
    die();
}
?>

//现在抛出错误：解析错误：语法错误，第23行意外'['，期待'）'function validateUser($ifUserExists['uID'], $ifUserExists['uUserType']) {

和买方/目录中的文件“index.php”：

<?php
session_start();
if($_SESSION['uUserType']!=1)
{ 
    die("You may not view this page. Access denied.");
}

function isLoggedIn()
{
    return (isset($_SESSION['valid']) && $_SESSION['valid']);
}

//if the user has not logged in
if(!isLoggedIn())
{
    header('Location: index.php');
    die();
}
?>

<?php 
    if($_SESSION['valid'] == 1){
        #echo "<a href='../logout.php'>Logout</a>";
        require_once('buyer_profile.php');
    }else{
        echo "<a href='../index.php'>Login</a>";
    }
?>

这一点是，当输入用户名和密码时，用户登录并定向到/buyer/index.php，到该网站的buyer部分。似乎每次我使用我测试的伪凭证登录时，它只是脱口而出：You may not view this page. Access denied。但是，如果我在浏览器中按回箭头返回，它会让我logged in和showing a link to logout。

我在拍摄时遇到了一些麻烦： 1）这里显示，测试我的sql query很好，事实确实如此。 http://i.stack.imgur.com/n2b5z.png

2）在它choing发出呜呜声之前尝试了echo 'the userid: ' . $userid; You may not view..并且它没有打印任何内容。

如何获得此userID？我仔细检查了数据库中的字段名称，一切都很好..

Answer 1

通过快速检查，您似乎在$_SESSION['uUserType'] = $userType中设置validateUser()，但似乎没有将$userType本身传递给该功能。因此，$_SESSION['uUserType']不会是1，而是$_SESSION['valid']，因为您将其设置为validateUser()中的{。}}。

我怀疑您应该将有效数据传递到validateUser，以便将其设置为会话。

e.g。

validateUser($ifUserExists['uID'], $ifUserExists['uUserType']);

function validateUser($uID, $uUserType) {
    $_SESSION['valid'] = 1;
    $_SESSION['uID'] = $uID;
    $_SESSION['uUserType'] = $uUserType; // 1 for buyer - 2 for merchant
}

在Php登录时拒绝访问

1 个答案: