doutuo7815 2018-02-18 13:04
浏览 566
已采纳

php mysql where语句,如果第二个条件为false,则返回true

I am running a mysql statement which actually evaluates to true despite the incorrectness of a value. Bellow is the function

<?php
public function login_user($username, $password){

      if(!empty($username) && !empty($password)){
        $sql = "SELECT * FROM `users` WHERE `user_name`='$username' AND `user_password`='$password'";
        $query = $this->link->query($sql);

        if($this->link->error){
            //return false;
            $this->log_db_error($this->link->error, $sql);
            return false;
        }
        else{

            return true;
        }
    }
    else{
      return false;
    }
  }
?>

Calling this function with the params and passing a correct username and a wrong password actually returns true, where am I messing up? Any help

  • 写回答

1条回答 默认 最新

  • dsqa6272 2018-02-18 13:14
    关注

    Because the sql query is totally valid even if the combination of username and password doesn't exist in database.

    You can achieve what you want by: Checking if query returns empty dataset.

    Some Tips: 1. Your query is prone to sql injection. It is good practice to use prepare and then bind all the input parameters. 2. It's good to keep passwords in hash (Like md5 or BCrypt) in database.

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论

报告相同问题?

悬赏问题

  • ¥35 用python实现除法算法中goldschmidt算法
  • ¥15 汇编代码转换成C代码
  • ¥15 除法算法中的归一化具体是怎么变的?
  • ¥20 集成电路的逻辑电路和晶体管简化图
  • ¥15 下载windows builder后的问题
  • ¥15 按要求对程序的逻辑进行更正
  • ¥50 悬赏帮写C++编程 诚信
  • ¥15 端口连接数为什么会有限制
  • ¥15 安卓数据提交之后格式不对
  • ¥15 需要数据库运行的图片