Index.php在实时网站上引起空警报

Question

So I have index.php has my default page. It works fine on xampp. So I uploaded my whole site to 1&1 (my domain/hosting provider) and when I try to go to my domain I get an empty alert with no message and a completely blank page.

I changed the name of the file to index.html and the webpage loaded just fine. So I know it must be something with the .php extention or my code up top.

I also added a file called .htaccess and it contains only:

DirectoryIndex index.php

Here is my php code at the top of index.php (replaced sensitive infow with *s):

<?php

//Connect to a database
  $host_name  = "******.db.1and1.com";
  $database   = "db****";
  $user_name  = "dbo******";
  $password   = "***z.0**";

  $connect = mysqli_connect($host_name, $user_name, $password, $database);
  //    echo("nice job");

//Take the values from the html form and assign them to variables
  $ID = $_POST['name'];
  $userpassword = $_POST['password'];

//If no passsowrd entered then go straight to index.php
  echo "<script type='text/javascript'>alert($userpassword);</script>";
  if ($userpassword == null) {
    header("Location: http://localhost:82/index3.php");
    die();
  }

//Check to see if the password matches the hashes
  if (md5($userpassword) === '******************' 
      or md5($userpassword) === '***********' 
      or md5($userpassword) === '****************' 
      or md5($userpassword) === '**************') 
 {
 //Add the visitor name to our list
    mysqli_query($connect, "INSERT INTO `WebsiteVisitors` (`Name`) VALUES  ('$ID')") or die("Error in INSERT: ".mysqli_error($connect));
      //    echo "You have entered the correct password, congrats.";

  // Start the session so they can access other pages
    session_start();
    $_SESSION['loggedIn'] = true;
  // Redirect them to rest of site
    header("Location: http://localhost:82/home.php");
    die();
   }

    else {
    header("Refresh: 0; url=index2.php");
    echo "<script type='text/javascript'>alert(\"Wrong Password. Check your     invitation card.\");</script>";

  }
  ?>

Answer 1

Since $_POST request comes only after submitting form in your case, you need to only execute the username and password checks if $_POST["name"] and $_POST["password"] exists.

So give an if statement if(isset($_POST['name']) && isset($_POST['password'])) before using and manipulating $_POST variables. Alson session_start() should be given at top of your script.

Below is your complete code including the check

<?php
session_start();
// session start should be at top of your script

error_reporting(E_ERROR); // reports only errors

//Connect to a database

$host_name  = "******.db.1and1.com";
$database   = "db****";
$user_name  = "dbo******";
$password   = "***z.0**";

$connect = mysqli_connect($host_name, $user_name, $password, $database);

// $_POST request comes only when form is submitted in your case. So check for $_POST['name'] and $_POST['password']

if(isset($_POST['name']) && isset($_POST['password'])) 
{

        $ID = $_POST['name'];
        $userpassword = $_POST['password'];

        //If no passsowrd entered then go straight to index.php

        if ($userpassword == null)
        {
                echo "<script type='text/javascript'>alert("Empty Password");</script>";
                header("Location: http://localhost:82/index3.php");
                die();
        }

        //Check to see if the password matches the hashes

        if (md5($userpassword) === '******************' 
                  or md5($userpassword) === '***********' 
                  or md5($userpassword) === '****************' 
                  or md5($userpassword) === '**************') 
       {

             //Add the visitor name to our list

             mysqli_query($connect, "INSERT INTO `WebsiteVisitors` (`Name`) VALUES  ('$ID')") or die("Error in INSERT: ".mysqli_error($connect));

              $_SESSION['loggedIn'] = true;

              // Redirect them to rest of site

              header("Location: http://localhost:82/home.php");
              die();
         }
         else
         {
               echo "<script type='text/javascript'>alert(\"Wrong Password. Check your     invitation card.\");</script>";

               header("Refresh: 0; url=index2.php");

        }

  }
  ?>