php - 登录脚本即使输入错误密码也会重定向

Question

这个问题不太可能对任何 future 的访客有帮助；它只与一个较小的地理区域、一个特定的时间点或一个非常狭窄的情况相关，通常不适用于全世界的互联网受众。如需帮助使此问题更广泛适用， visit the help center 。

已关闭 10 年前。

如果您发现这个问题与其他问题类似，我很抱歉，但我已经检查过并且找不到合适的解决方案。我的登录检查脚本似乎有问题，因为即使我输入了错误的密码，它也会定向到登录成功页面，但我找不到位置。请帮我。这是代码:

<?php

session_start();

mysql_connect("localhost", "root", "")or die("cannot connect"); 
mysql_select_db("planner")or die("cannot select DB");


$myusername = mysql_real_escape_string ($_POST['username']);
$mypassword = mysql_real_escape_string ($_POST['password']);


$sql="SELECT username,password FROM members WHERE username='$myusername'";



if($result=mysql_query($sql)){
    $found_user=mysql_fetch_array($result);
    if (mysql_num_rows($result)>0){

$_SESSION['myusername']=true; 
header("location:login_success.php");
}

else {
echo "Wrong Username or Password";
}
}
?>

updated script:

<?php

session_start();

mysql_connect("localhost", "root", "")or die("cannot connect"); 
mysql_select_db("planner")or die("cannot select DB");


$myusername = mysql_real_escape_string ($_POST['username']);
$mypassword = md5(mysql_real_escape_string ($_POST['password']));


$sql="SELECT username,password FROM members WHERE username='$myusername' AND password='$mypassword'";




if($result=mysql_query($sql)){
    $found_user=mysql_fetch_array($result);
    if (mysql_num_rows($result)!=0){

$_SESSION['myusername']=true; 
header("location:login_success.php");
}

else {
echo "Wrong Username or Password";
}
}
?>



 now it always says wrong username and password entered even though
    with right username and password entered. And here is the login form:


<form method="post" action="check_login.php">
    <p><input type="text" name="username" value="" placeholder="Username"></p>
    <p><input type="password" name="password" value="" placeholder="Password"></p>

    <p class="submit"><input type="submit" name="submit" value="Login"></p>
  </form>

Answer 1

因为您只是检查用户名而不是两者

$sql="SELECT username,password FROM members 
WHERE username='$myusername' AND password = '$mypassword'";

您必须使用 SALT 转换密码并进行检查。