php - 检查用户名和密码是否正确

Question

正如我现在的代码一样，无论用户名/密码是否匹配，我总是得到 echo "Username/Password incorrect.";。我的问题是，我在下面的代码中做错了什么让 php 总是回显“用户名/密码不正确”

<?php
require 'privstuff/dbinfo.php';

$password1 = $_POST["password1"];
$username = $_POST["username"];

$mysqli = new mysqli(DB_SERVER, DB_USER, DB_PASSWORD, DB_DATABASE);


if(mysqli_connect_errno()) {
    echo "Connection Failed. Please send an email to owner@othertxt.com regarding this problem.";
    exit();
}

if ($stmt = $mysqli->prepare("SELECT username, password FROM accounts WHERE username=? and password=?")) {

    $db_pw = password_hash($password1, PASSWORD_BCRYPT);

    $stmt->bind_param("ss", $username, $db_pw);
    $stmt->execute();
    if ($stmt->affected_rows > 0) {

        echo "Logged in.";
    }else{
        echo "Username/Password incorrect.";
    }
    $stmt->close();
}
$stmt->close();

$mysqli->close(); 

?>

更新 我已将 if ($stmt->affected_rows > 0) 更改为 if ($stmt->num_rows)。还是不行更新 2 我意识到问题出在我使用 password_hash($password1, PASSWORD_BCRYPT); 我没有意识到哈希每次都会给出不同的字符串。我不明白如何使用 password_verify

Answer 1

mysqli_stmt_affected_rows() 的文档说:

This function only works with queries which update a table. In order to get the number of rows from a SELECT query, use mysqli_stmt_num_rows() instead.

您还需要调用 mysqli_stmt_store_results()首先，缓冲结果。

$stmt->store_results();
if ($stmt->num_rows > 0) {
    ...
}