PHP-MySQL登录系统

Question

这是我第一次使用 PHP 和 MySQL 制作登录系统，用户可以在其中输入用户名和密码，然后 php 脚本会检查用户名和密码是否存在于数据库中。

当用户输入正确的信息时，它会显示“成功登录到用户个人资料页面...”消息，这一切都很好。但是，如果用户输入了错误的信息，“抱歉...您输入了错误的 ID 和密码...请重试...”消息应该出现，但页面是空白的。这是为什么？

<?php
define('DB_HOST','localhost');
define('DB_NAME','test'); //name of database
define('DB_USER','root'); //mysql user
define('DB_PASSWORD',''); //mysql password

$con = new mysqli(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME) or die(mysqli_connect_error());
/* check connection */
if (mysqli_connect_errno()) {
    printf("Connect failed: %s\n", mysqli_connect_error());
}
$db = mysqli_select_db($con,DB_NAME) or die(mysqli_connect_error()); 

/*
$ID = $_POST['user'];
$Password = $_POST['pass'];
*/
function SignIn(mysqli $con){
    session_start(); //starting the session for user profile page
    if(!empty($_POST['user'])){ //checing the 'user' name which is from Sign-in.html, is it empty or have some text
        $query = mysqli_query($con,"SELECT * FROM UserName where userName = '$_POST[user]' AND pass = '$_POST[pass]'") or die(mysqli_connect_error());
        $row = mysqli_fetch_array($query) or die(mysql_error());
        if(!empty($row['userName']) AND !empty($row['pass'])){
            $_SESSION['userName'] = $row['pass'];
            echo "SUCCESSFULLY LOGIN TO USER PROFILE PAGE...";
        }
        else{
            echo "SORRY...YOU ENTERED WRONG ID AND PASSWORD...PLEASE RETRY...";
        }
    }
}

if(isset($_POST['submit'])){
    SignIn($con);
}
?>

Answer 1

首先，我必须声明您的代码很容易出现 SQL injection <= 一定要读一下，更不用说以纯文本形式存储密码了，这是非常不鼓励的。

• 不要以纯文本形式存储密码，否则您最终会遭到黑客攻击。

• 有关注入(inject)和密码存储的所有上述内容，请参阅我的脚注。

您还将 MySQL API 与 mysql_error() 混合使用，而这不会与 mysqli_ 函数混合使用。它需要是 mysqli_error($con)。

---

现在，您的代码因这一行而失败:

if(!empty($row['userName']) AND !empty($row['pass']))

即使有人输入了错误或不存在的用户名和/或密码，它仍将保持 TRUE，因为这些行不是空的。

因此它永远不会进入脚本的 else 部分。

要开始，您需要执行以下操作:

替换:

if(!empty($row['userName']) AND !empty($row['pass']))

与:

$row = mysqli_fetch_array($query);
    $username = $row['userName'];
    $pw = $row['pass'];

if($user==$username && $pass==$pw) {
// $user and $pass are from POST
// $username and $pw are from the rows

    $_SESSION['userName'] = $row['pass'];

    echo "Successfully logged in.";
    }

else { echo "Invalid."; }

在 SignIn() 函数中使用以下内容时:

$user = mysqli_real_escape_string($con,$_POST['user']);
$pass = mysqli_real_escape_string($con,$_POST['pass']);

并将您的查询替换为:

$query = mysqli_query($con,"SELECT * FROM UserName 
        where userName = '$user' 
        AND pass = '$pass'") 
        or die(mysqli_connect_error());

---

脚注:

• 对于密码存储，使用 CRYPT_BLOWFISH或 PHP 5.5 的 password_hash()功能。
  对于 PHP < 5.5，使用 password_hash() compatibility pack .

• 此外，关于 SQL 注入(inject)，use mysqli with prepared statements , 或 PDO with prepared statements ，它们更安全。

---

编辑:

Oh yea and also I changed my code to yours, but now everytime I login It displays Invalid, even with the right username and password. Any ideas?It seems to be failing the if($user==$username && $pass==$pw) if statement.

这是我用来测试它的东西，你可以用你自己的和其他调整替换数据库凭证，因为我没有使用表单，而是硬编码值。

如果输入了错误的用户/密码，这实际上会跳转到 else。

<?php 
$DB_HOST = 'xxx';
$DB_USER = 'xxx';
$DB_PASS = 'xxx';
$DB_NAME = 'xxx';

$con = new mysqli($DB_HOST, $DB_USER, $DB_PASS, $DB_NAME) or die(mysqli_connect_error());

/* check connection */
if (mysqli_connect_errno()) {
    printf("Connect failed: %s\n", mysqli_connect_error());
}

 function SignIn($con){

$_POST['user'] = "John";
$user = $_POST['user'];

$_POST['pass'] = "12345";
$pass = $_POST['pass'];

   // session_start(); //starting the session for user profile page
   if(isset($_POST['user'])){

$query = mysqli_query($con,"SELECT * 
        FROM UserName where userName = '$_POST[user]' 
        AND pass = '$_POST[pass]'") 
        or die(mysqli_connect_error());


$row = mysqli_fetch_array($query);
    $username = $row['userName'];
    $pw = $row['pass'];

if($user==$username && $pass==$pw) {
    echo "Successfully logged in.";
    }

else { echo "Invalid"; }


    } // brace for isset post user

} // brace for function

if(isset($_POST['submit'])){
   echo SignIn($con);
}
?>