duan198299 2015-12-10 05:00
浏览 50
已采纳

管理员登录表单有问题

I am currently working on making a admin login form for a website I am making the problem is that whenever I try and submit the form it automatically accepts it and doesn't not display the error message for invalid credentials if I enter the wrong value or nothing at all

<?php require_once('dbadmin.php');?>
<?php
session_start();
error_reporting(E_ALL);
ini_set("display_errors", 1);
if(isset($_POST['adminlogin'])) {
    $username = trim($_POST['user']);
    $password = md5(trim($_POST['password'])); // wrap the trim() function with md5() function
    $sql = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
    $result = mysqli_query($connect, $sql) or die("Invalid query: ".mysql_error());
    if(mysql_num_rows($result)==0) {
        $confim = '<h2 style="color:red;">Invalid Credentials!</h2>';
    } else {
        $_SESSION['user'] = $username;
        $confirm = '<h2> Login Successful</h2>';
    }
}
?>
<!DOCTYPE html>
<html lang="en">
    <head>
    <meta charset="UTF-8">
    <title> website</title>
    <link rel="stylesheet" type="text/css" href="css/style.css" />
    </head>
    <body>
      <header><img src="images/eastersealsclevelogo.png" alt="Easter Seals Logo" width="445" height="300"/> </header>
      <nav>
         <ul>
           <li><a href="index.html" class="current">Home</a></li>
           <li><a href="signup.php" class="current">Run Sign-Up</a></li>
           <li><a href="refer.php" class="current">Refer-a-Friend</a></li>
         </ul>
      </nav>
    <h1>Enter Your Login Information</h1>
    <?php if(isset($confirm)) echo $confirm; ?> 
       <form method="post" name="adminlogin" id="adminlogin" title="adminlogin" action="admin_login.php">
    <p>User: <br> <input type="text" name="user"></p>
    <p>Password: <br><input type="password" name="password"></p>
    <p><input type="submit" name="adminlogin" id="adminlogin" value="Login"></p>
</form>
    </p>
    <footer></footer>
   </body>

</html> 

error i keep getting now Warning: mysqli_query() expects parameter 1 to be mysqli, resource given in filepath/admin_login.php on line 10 Invalid query:

  • 写回答

1条回答 默认 最新

  • duanji1899 2015-12-10 05:04
    关注

    The query is hard-coded, so if you have a username of 'username' with a password of 'password', the SELECT will always find it.

    $sql = "SELECT * FROM users WHERE username = 'username' AND password = 'password'";
    

    replace it to:

    $sql = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
    

    Don't use the mysql functions because they have been deprecated, use mysqli or PDO.

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论

报告相同问题?

悬赏问题

  • ¥20 关于#硬件工程#的问题,请各位专家解答!
  • ¥15 关于#matlab#的问题:期望的系统闭环传递函数为G(s)=wn^2/s^2+2¢wn+wn^2阻尼系数¢=0.707,使系统具有较小的超调量
  • ¥15 FLUENT如何实现在堆积颗粒的上表面加载高斯热源
  • ¥30 截图中的mathematics程序转换成matlab
  • ¥15 动力学代码报错,维度不匹配
  • ¥15 Power query添加列问题
  • ¥50 Kubernetes&Fission&Eleasticsearch
  • ¥15 報錯:Person is not mapped,如何解決?
  • ¥15 c++头文件不能识别CDialog
  • ¥15 Excel发现不可读取的内容