dongmen5867 2015-12-30 18:43
浏览 21
已采纳

立即重定向到索引而不登录验证

I've tried creating a login page, but the what ever I put into the text fields and hit the login button, it automatically redirects itself to the index page when it should notify the user wrong username/passowrd; Why is that?

<html>
<body>
<div>
    <form method="post" action="customer_login.php">
        <table width='500' align='center' bgcolor='skyblue'>
            <tr align='center'>
                <td colspan ='4'><h2>Login/Register to Proceed</h2></td>
            </tr>   

            <tr>
                <td align='right'><b>Email:</b></td>
                <td><input type='text' placeholder='Enter Email' name='c_email'/></td>
            </tr>

            <tr>
                <td align='right'><b>Password:</b></td>
                <td><input type='password' name='pass' placeholder="Enter Password"/></td>
            </tr>

            <tr align='center'>
                <td colspan='4'><input type='submit'  value="Login" name="login"/></td>
            </tr>
        </table>
            <h2 style=' float:center;padding:10px;'><a href='customer_register.php' style='text-decoration:none;'> Don't have an account?</a></h2>
    </form>
</div>
</body>
</html>


<?php
    if(isset($_POST['login'])){
    include("includes/db.php");
    $username = strip_tags($_POST['c_email']);
    $password = strip_tags($_POST['pass']);

    $username = stripslashes($username);
    $password = stripslashes($password);

    $username = mysqli_real_escape_string($username);
    $password = mysqli_real_escape_string($password);

    $sql = "select * from customer where customer_email ='$username' LIMIT 1";
    $query_login = mysqli_query($con, $sql);
    $row = mysqli_fetch_array($query_login);
    $email = $row['customer_email'];
    $db_pass = $row['customer_pass'];

    if($password==$db_pass){
        $_SESSION['customer_email'] = $email;
        header("Location:index.php");
    }else{
        echo "<h2 style='color:red;'>Wrong Email/Password!</h2>";
    }
        }
?>

I've already start the session somewhere in index.php. This is an e-commerce website where the user can add items to the cart even without logging in but should log in during checkout.

  • 写回答

1条回答 默认 最新

  • dongzhang7157 2015-12-30 20:10
    关注

    Give this a try:

    <?php
    // Anti-Caching (hopefully):
    header('Expires: Sun, 01 Jan 2014 00:00:00 GMT');
    header("Cache-Control: no-store, no-cache, must-revalidate, max-age=0");
    header("Cache-Control: post-check=0, pre-check=0", false);
    header("Pragma: no-cache");

    $_ERROR_MESSAGE = NULL;

    if(isset($_POST['Login'])){
        include("includes/db.php");
        $username = strip_tags($_POST['c_email']);
        $password = strip_tags($_POST['pass']);

        $username = $con->real_escape_string($username);

        $sql = "SELECT * FROM `customer` WHERE `customer_email` ='$username' LIMIT 1";
        $query_login = $con->query($sql);

        if($query_login->num_rows > 0){

            $row = $query_login->fetch_assoc();
            $email = $row['customer_email'];
            $db_pass = $row['customer_pass'];

            if($password == $db_pass){ // Insecure password check occurs here (use hashing & salts)
                $_SESSION['customer_email'] = $email;
                header($_SERVER['SERVER_PROTOCOL'] . ' 303 See Other', true, 303);
                header("Location: index.php");
                exit(); // Stop processing and let user be redirected. Do not output login page.
            }else{
                // Incorrect Password
                $_ERROR_MESSAGE = "<h2 style='color:red;'>Wrong Email/Password!</h2>";
            }
        }else{
            // Invalid Email/Username
            $_ERROR_MESSAGE = "<h2 style='color:red;'>Wrong Email/Password!</h2>";
        }

        // Free up memory and close connections
        $query_login->free();
        $con->close();

    } // Else, output the page
?>
<!DOCUMENT HTML>
<html>
    <head>
        <title>Some Login Page</title>
    </head>
    <body>
        <div>
            <?php
                // Check if we need to output an error message here:
                if($_ERROR_MESSAGE !== NULL){
                    echo $_ERROR_MESSAGE;
                }
            ?>
            <form method="post" action="customer_login.php">
                <table width='500' align='center' bgcolor='skyblue'>
                    <tr align='center'>
                        <td colspan ='4'><h2>Login/Register to Proceed</h2></td>
                    </tr>
                    <tr>
                        <td align='right'><b>Email:</b></td>
                        <td><input type='text' placeholder='Enter Email' name='c_email'/></td>
                    </tr>

                    <tr>
                        <td align='right'><b>Password:</b></td>
                        <td><input type='password' name='pass' placeholder="Enter Password"/></td>
                    </tr>

                    <tr align='center'>
                        <td colspan='4'><input type='submit'  value="Login" name="login"/></td>
                    </tr>
                </table>
                    <h2 style=' float:center;padding:10px;'><a href='customer_register.php' style='text-decoration:none;'> Don't have an account?</a></h2>
            </form>
        </div>
    </body>
</html>

    I don't know why it was redirecting before. My only guess would be that possibly the response from customer_login.php was being cached by your browser. To help prevent that, I have included some Anti-Cache headers at the top (which should prevent the caching issue as long as the browser complies). Also, I rearranged the PHP section to be at the top because, technically, you are not supposed to set a header after you have already started outputting the body. I also rewrote your MySQLi to be object-oriented (personal preference).

    By the way, just based on what I am seeing here, your database is insecure. It looks like you are storing the passwords in plaintext. So, if the database was ever compromised, the passwords of all users would be exposed. For the safety of your users/customers, please consider using a cryptographically secure hashing algorithm with a unique salt for each user to prevent that.

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论

报告相同问题？

悬赏问题

  • ¥15 表达式必须是可修改的左值
  • ¥15 如何绘制动力学系统的相图
  • ¥15 对接wps接口实现获取元数据
  • ¥20 给自己本科IT专业毕业的妹m找个实习工作
  • ¥15 用友U8：向一个无法连接的网络尝试了一个套接字操作，如何解决？
  • ¥30 我的代码按理说完成了模型的搭建、训练、验证测试等工作(标签-网络|关键词-变化检测)
  • ¥50 mac mini外接显示器 画质字体模糊
  • ¥15 TLS1.2协议通信解密
  • ¥40 图书信息管理系统程序编写
  • ¥20 Qcustomplot缩小曲线形状问题