php用mysql登录。接受任何内容作为成功登录

Question

无论我在登录框中输入什么，它都会接受它作为成功登录我根本无法解决这个错误...我是 php 的新手，但希望我能让它发挥作用。

<?php
session_start();
include_once "inc/connect.php";

if($_POST['login']){
    include_once("inc/connect.php");
    $username = strip_tags($_POST['username']);
    $password = strip_tags($_POST['password']);

    $username = stripslashes($username);
    $password = stripslashes($password);

    $username = mysqli_real_escape_string($username);
    $password = mysqli_real_escape_string($password);
    $password = md5($password);

    $sql = "SELECT * FROM users WHERE username='$username' LIMIT 1";
    $query = mysqli_query($db, $sql);
    $row = mysqli_fetch_array($query);
    $id = $row['id'];
    $db_password = $row['password']; 

    if($password == $db_password) {
        $_SESSION['username'] = $username;
        $_SESSION['id'] = $id;
        header("Location: board.php");

    } else {
        echo "you didn't enter the corret detail";
    }


}

?>

Answer 1

如果您尝试在代码中回显您的变量，这会有所帮助，这会向您显示开发过程中变量的值。它不是您问题的解决方案，但可以帮助您调试和查找错误。

我看到的另一件事是你的 SQL 代码，什么是不安全的。请检查:How can I prevent SQL injection in PHP?

更新了您的代码:

<?php
session_start();
include_once "inc/connect.php";

if($_POST['login']){
    include_once("inc/connect.php");
    $username = strip_tags($_POST['username']);
    $password = strip_tags($_POST['password']);

    echo "username: " . $username . "<br>";
    echo "password: " . $password . "<br>";

    $username = stripslashes($username);
    $password = stripslashes($password);

    echo "username: " . $username . "<br>";
    echo "password: " . $password . "<br>";

    $username = mysqli_real_escape_string($username);
    $password = mysqli_real_escape_string($password);
    $password = md5($password);

    echo "username: " . $username . "<br>";
    echo "password: " . $password . "<br>";

    $sql = "SELECT * FROM users WHERE username='$username' LIMIT 1";
    $query = mysqli_query($db, $sql);
    $row = mysqli_fetch_array($query);
    $id = $row['id'];
    $db_password = $row['password']; 

    echo "password1: " . $db_password. "<br>";
    echo "password2: " . $password . "<br>";

    if($password == $db_password) {
        $_SESSION['username'] = $username;
        $_SESSION['id'] = $id;
        header("Location: board.php");

    } else {
        echo "you didn't enter the corret detail";
    }


}
?>

希望对您有所帮助!