PHP MySQL登录设置错误

Question

这对我来说真的很新，我只知道最基础的知识。我正在为网页创建前端登录(显然安全性不是什么大问题，否则我不会这样做)。我一直对我的“where”子句有异议，指出“用户”不存在。数据库设置如下:数据库名=连通性表=用户 用户有 id、user 和 pass。有人想给我一些指示吗？提前致谢。

<?php
define('DB_HOST', 'localhost');
define('DB_NAME', 'connectivity');
define('DB_USER','root');
define('DB_PASSWORD','');
$con=mysql_connect(DB_HOST,DB_USER,DB_PASSWORD) or die("Ya done goofed:  " . mysql_error());
$db=mysql_select_db(DB_NAME,$con) or die("Ya done goofed: " . mysql_error());

function SignIn()
{
session_start();   
if(!empty($_POST['user']))  


{
     $query = mysql_query("SELECT *  FROM users where user = `$_POST[user]`  AND pass = '$_POST[pass]'") or die(mysql_error());
    $row = mysql_fetch_array($query) or die(mysql_error());
    if(!empty($row['user']) AND !empty($row['pass']))
    {
        $_SESSION['user'] = $row['pass'];
        echo "SUCCESSFULLY LOGIN TO USER PROFILE PAGE...";

    }
else
{
    echo "SORRY... YOU ENTERD WRONG ID AND PASSWORD... PLEASE RETRY...";
}
}
}
if(isset($_POST['submit']))
{
    SignIn();
}

?>

Answer 1

请停止使用mysql_*。使用 mysqli_* 或 PDO。看看代码:-

<?php
// Force PHP to show errors
error_reporting(E_ALL); // Get all type of errors if any occur in code
ini_set('display_errors',1); // Display those errors

session_start(); // start session

define('DB_HOST', 'localhost');
define('DB_NAME', 'connectivity');
define('DB_USER','root');
define('DB_PASSWORD','');

$con = mysqli_connect(DB_HOST,DB_USER,DB_PASSWORD,DB_NAME) or die("connection not established"); Or use  $con = mysqli_connect('localhost','root','','connectivity') or die("connection not established");

if(isset($_POST['submit'])){
    SignIn();
}

function SignIn(){
   if(!empty($_POST['user'])) {
        $username = mysqli_real_escape_string($con , $_POST['user']); // prevent form SQL injection
        $password = mysqli_real_escape_string($con , $_POST['pass']); // prevent form SQL injection
        $query = mysqli_query($con,"SELECT *  FROM users where user = '".$username."'  AND pass = '".$password."'") or die(mysqli_error($con));
        if(mysqli_num_rows($query) > 0){ // check count of resultset
            $_SESSION['user'] = $_POST['pass'];
            echo "SUCCESSFULLY LOGIN TO USER PROFILE PAGE...";
        }else{
            echo "SORRY... YOU ENTERD WRONG ID AND PASSWORD... PLEASE RETRY...";
        }
    }
}
?>