php - 如果该人被禁止 php mysql，页面将不会死()

Question

<?php
include('session.php');
?>
<?php 
require_once('mysql_connect.php');
$query2 ="SELECT  id, username, banned FROM login WHERE username ='$login_session'";
$result2 = mysql_query($query2) OR die($mysql_error());
$row = mysql_num_rows($result2);

if($row['banned'] == 1) {
die();
}

?>

session .php

<?php
// Establishing Connection with Server by passing server_name, user_id and password as a parameter
$connection = mysql_connect("localhost", "", "");
// Selecting Database
$db = mysql_select_db("", $connection);
session_start();// Starting Session
// Storing Session
$user_check=$_SESSION['login_user'];
// SQL Query To Fetch Complete Information Of User
$ses_sql=mysql_query("select username from login where username='$user_check'", $connection);
$row = mysql_fetch_assoc($ses_sql);
$login_session =$row['username'];
if(!isset($login_session)){
mysql_close($connection); // Closing Connection
header('Location: login.php'); // Redirecting To Home Page
}
?>

如您所见，我试图阻止被禁止加载 profile.php 的人

它不会阻止个人资料页面加载

Answer 1

thanks fred, that worked – KIXEYE

make it to an answer, ill mark as answered as soon as i can – KIXEYE

按照OP的意愿:

您为 $row 使用了错误的函数。要么使用一个将获取行作为数组的方法，要么将 if($row['banned'] == 1) 更改为 if($row == 1)使用 mysql_num_rows。

---

脚注:

您现在的密码是开放给SQL injection .使用 mysqli with prepared statements , 或 PDO with prepared statements ，它们更安全。

---

示例来自 https://stackoverflow.com/a/6620252/

$user = "bob";
$user = mysql_real_escape_string($user);
$result = mysql_query("SELECT COUNT(*) AS num_rows FROM my_table WHERE username='{$user}' LIMIT 1;");
$row = mysql_fetch_array($result);
if($row["num_rows"] > 0){
   //user exists
}

---

编辑:

如果您的 banned 行包含 1 或 0 以检查它们是否被禁止，然后将另一个参数添加到您的 where 子句。即:WHERE username ='$login_session' AND banned !=1 如果 banned 列是 int 类型。如果不是，请将 1 括在引号中。

• 这转换为用户名存在且为“John”且禁止不等于 1 的位置。或者使其成为 0，由您选择。