php - 如何禁用 php/mysql 用户帐户

Question

我正在尝试拥有可以启用或禁用的用户帐户。

我的表格中有一个事件字段设置为"is"或“否”。

这是我的登录页面代码。

<?php
/* User login process, checks if user exists and password is correct */

require_once 'includes/db.php';

// Escape email to protect against SQL injections
$email = $mysqli->escape_string($_POST['email']);
$result = $mysqli->query("SELECT * FROM dxd_membership WHERE email='$email'");
if ( $result->num_rows == 0 ){ // User doesn't exist
$_SESSION['message'] = "User with that email doesn't exist!";
header("location: error.php");
}
else { // User exists
    $user = $result->fetch_assoc();
$active = $mysqli->query("SELECT * FROM dxd_membership WHERE email = '$email' AND active = 'YES'");

if ($active == '1')
{
    if ( password_verify($_POST['password'], $user['password']) ) {
        $userid = $_SESSION['userid'];
        $_SESSION['email'] = $user['email'];
        $_SESSION['firstname'] = $user['firstname'];
        $_SESSION['lastname'] = $user['lastname'];
        $_SESSION['username'] = $user['username'];
        $_SESSION['paynum'] = $user['paynum'];
        $_SESSION['empnum'] = $user['empnum'];
        $_SESSION['phone'] = $user['phone'];
        $_SESSION['active'] = $user['active'];
        $_SESSION['lastlogin'] = $user['lastlogin'];
        $_SESSION['signup'] = $user['signup'];
        $_SESSION['lastupdate'] = $user['lastupdate'];

        // This is how we'll know the user is logged in
        $_SESSION['logged_in'] = true;

        $update = $mysqli->query("UPDATE dxd_membership SET lastlogin=NOW() WHERE email = '$email'");

        header("location: welcome.php");
    }

    else {
        $_SESSION['message'] = "You have entered wrong password please try again!";
        header("location: error.php");
    }
}

else {
    header("location: disabled.php");
}
}
?>

我确信这是一个愚蠢的错误，但它不会检查事件字段，然后如果事件为"is"，则让用户登录到welcome.php页面，或者如果他们的用户将其发送到disabled.php页面帐户事件设置为否(禁用)。

任何人都可以帮助我更正代码以使其正常工作。

谢谢

Answer 1

看，我在您的代码中发现了几个问题。第一个是对相同数据的双重查询。您可以将整个事情简化为一个查询。

另一个(也是更重要的)事实是，您只是将数据附加到 SQL 查询，其中 MySQLi 的整个目标是通过绑定(bind)参数来避免注入(inject)。因此，一种更正确的方法是:

编辑: escape_string 避免了这种情况。我完全忽略了它。

<?php
    /* User login process, checks if user exists and password is correct */

    require_once 'includes/db.php';

    // Escape email to protect against SQL injections
    $email = $mysqli->escape_string($_POST['email']);
    $result = $mysqli->query("SELECT * FROM dxd_membership WHERE email = '{$email}'");
    if ( $result->num_rows == 0 ){ // User doesn't exist
        $_SESSION['message'] = "User with that email doesn't exist!";
        header("Location: error.php");
        exit; // Add an "exit" here, because if you add something else, it will run too (even if you asked to redirect... basically is the browser the one that chooses if it follows the redirect or not, but your script still goes on).
    }
    else { // User exists
        $user = $result->fetch_assoc();

        // There's no point in filtering using another MySQL query, since YOU ALREADY HAVE THIS DATA. Just use PHP to read it and act appropiately.
        // Doing another query is just WASTING resources for no useful purpose.
        //$active = $mysqli->query("SELECT * FROM dxd_membership WHERE email = '$email' AND active = 'YES'");
        if ( $user['active'] == 'YES' ) {
            // Your processing here, you get the idea
        }
    }
?>

当然，最好的选择是使用 MySQLi 语句并使用 bind_param/execute。这个示例只是为了遵循您使用 MySQLi 的风格。