PHP-MYSQLI : My login scripts logs direct users into the same page

Question

在大多数情况下，我的网站可以完美登录!当用户登录他们的帐户时，我可以愉快地验证用户的电子邮件，但我只是在测试我的登录页面，并意识到不同的用户被定向到完全相同的页面，无论他们的电子邮件地址或密码如何，并且能够获得访问权限给其他用户的信息。我该怎么做才能解决这个问题？

当他们登录帐户页面时，有没有办法同时检查电子邮件地址和帐户 ID？

PHP 登录页面

         if (isset($_POST['login']))

        //database varianbles
            $c_email = $_POST['email'];
        $c_password = $_POST['pass1'];


        // select login details
        $sel_c = "SELECT * FROM Cus_Register WHERE Cus_Email='$c_email' AND Cus_Password='$c_password'";

        $run_c = mysqli_query($dbc, $sel_c);
        //check if customer is on databse
        $check_customer = mysqli_num_rows($run_c);




        if ($check_customer == 0) {
            echo "password or email is incorrect please try again";
            exit();
          } else {
            session_start();
            $_SESSION['Cus_Email'] = $c_email;

  //                echo "<script> alert ('Logged in successfully')</script>";
            echo "<script>window.open('./customer/Cus_Account.php','_self')      </script>";
            exit();
        }
        ?>

客户账户页面

 session_start();
 //if user is not logged re-direct them to login page
 if (isset($_SESSION['Cus_Email'])) {

} else {
 //    header("Location: ./login.php");
echo "<script>window.open('../login.php','_self')</script>";
}
 ?>

客户注册表

  CREATE TABLE `Cus_Register` (
 `Cus_Email` varchar(100) NOT NULL,
 `Cus_Password` varchar(50) NOT NULL,
 `Cus_confirm_Password` varchar(50) NOT NULL,
 `AccountID` tinyint(11) NOT NULL AUTO_INCREMENT,
 PRIMARY KEY (`AccountID`),
 UNIQUE KEY `Cus_Email` (`Cus_Email`)
 ) ENGINE=InnoDB AUTO_INCREMENT=3 DEFAULT CHARSET=outfit

选择信息

<?php
$details = $dbc->query("SELECT * FROM Cus_acc_details");
$cus_dets = $details->fetch_array(MYSQLI_BOTH);

//session_start does not work here 

$_SESSION['fname'] = $cus_dets['CUS_Fname'];
$_SESSION['lname'] = $cus_dets['Cus_Lname'];
$_SESSION['phone'] = $cus_dets['CUS_Phone'];
$_SESSION['CustomerID'] = $cus_dets['CustomerID'];
?>

Answer 1

您需要指定要SELECT 的行，您的查询当前选择了所有行，因此他们可以看到其他用户的信息。

客户帐户页面中没有任何可更改的内容，因为没有发生任何查询。

您在 SELECT INFO 页面中的代码应该是:

session_start();

$c_email = $_SESSION['Cus_Email'];

$details = $dbc->query("SELECT * FROM Cus_acc_details WHERE Cus_Email = '$c_email'");
$cus_dets = $details->fetch_array(MYSQLI_BOTH);

$_SESSION['fname'] = $cus_dets['CUS_Fname'];
$_SESSION['lname'] = $cus_dets['Cus_Lname'];
$_SESSION['phone'] = $cus_dets['CUS_Phone'];
$_SESSION['CustomerID'] = $cus_dets['CustomerID'];

---

此外，在您的登录页面中，您应该使用 mysqli_real_escape_string() 防止 MySQL 注入(inject):

$c_email = mysqli_real_escape_string($dbc, $_POST['email']);
$c_password = mysqli_real_escape_string($dbc, $_POST['pass1']);

---

提示:您不应将用户密码存储为纯文本，您应该对其进行散列/加密。

在 PHP 5.5 中，有一个密码哈希函数:http://php.net/manual/en/ref.password.php .