dongzhuo1880 2013-05-12 16:54
浏览 66

简单登录连接到MySQL - 什么是错的?

I looked on http://www.phpportalen.net/wiki/index.php?page=Enkel+inloggning+med+MySql+och+sessioner to how to do a simple login.

But when i try to login now it says that the username or password is wrong. So Im guessing something is not right in my control dokument, where im checking the usernamne and password to the database.

In the exampel i looked on they have it all in the same page, so im guessing I need to change more than i thougt.

This is the code in the loginside:

<?php
session_start();
?>
<!DOCTYPE html>
<html>
    <head>
        <meta charset="utf-8" />
        <title></title>
        <link href="stylesheet.css" media="screen" rel="stylesheet" type="text/css" />
    </head>
    <body>
        <?php
        if(!isset($_SESSION["sess_user"])){
            if(isset($_GET['badlogin'])){
                echo "Fel användarnamn eller lösenord, försök igen!";
            }
        ?>
            <form method="post" action="check.php">
            <p>User</p>
            <input name="user" type="text" />
            <p>Password</p>
            <input name="password" type="text" />
            <input name="logIn" type="submit" value="Log in" />
            </form>
        <?php
        }
        else{
            header("Location: admin.php");
        }
        ?>
    </body>
</html>

And this is the code in my controlside:

<?php
session_start();
?>
<?php
function db_escape($post){
    if(is_string($post)){
        if(get_magic_quotes_gpc()){
            $post = stripslashes($post);
        }
        return mysqli_real_escape_string($post);
    }
    foreach($post as $key => $val){
        $post[$key] = db_escape($val);
    }
    return $post;
}
if(isset($_POST["logIn"])){
    // Connect to db
    $dbConn = mysqli_connect("localhost","sabe0011","lösen","sabe0011");
    $dbConn->set_charset("utf8");

    // Check connection
    if(mysqli_connect_errno($dbConn)){
        echo "Failed to connect to MySQL: " . mysqli_connect_error();
    }

    $_POST = db_escape($_POST);
    $checkUserSQL = mysqli_query($dbConn, "SELECT * FROM Users WHERE User ='{$_POST['user']}' AND Password ='{$_POST['password']}'");

    if(mysqli_num_rows($checkUserSQL) == 0){
        header("Location: login.php?badlogin=");
        exit;
    }

    $_SESSION['sess_id'] = mysqli_store_result($checkUsersSQL, 0);
    $_SESSION['sess_user'] = $_POST['user'];
    header("Location: admin.php");
    exit;
}
?>
  • 写回答

1条回答 默认 最新

  • du3932066 2013-05-12 17:05
    关注

    Your parameters in your query should be escaped like:

    $checkUserSQL = mysqli_query($dbConn, "SELECT * FROM Users WHERE User =" . $_POST['user'] . " AND Password = " . $_POST['password']);
    

    But in term of security, you have to see at the prepared query here.

    评论

报告相同问题?

悬赏问题

  • ¥15 2024-五一综合模拟赛
  • ¥15 下图接收小电路,谁知道原理
  • ¥15 装 pytorch 的时候出了好多问题,遇到这种情况怎么处理?
  • ¥20 IOS游览器某宝手机网页版自动立即购买JavaScript脚本
  • ¥15 手机接入宽带网线,如何释放宽带全部速度
  • ¥30 关于#r语言#的问题:如何对R语言中mfgarch包中构建的garch-midas模型进行样本内长期波动率预测和样本外长期波动率预测
  • ¥15 ETLCloud 处理json多层级问题
  • ¥15 matlab中使用gurobi时报错
  • ¥15 这个主板怎么能扩出一两个sata口
  • ¥15 不是,这到底错哪儿了😭