php - 密码在 PHP 登录系统中不起作用

Question

我正在尝试在我的网络服务器上设置一个 PHP 成员(member)区域，该区域具有散列和加盐密码。我注册了一个帐户并检查了数据库 - 用户已按预期创建 - 一切看起来都很好。问题是每当我尝试登录时，它都会说登录不正确(用户名或密码)。当然，这是在测试区域中完成的，我注册的用户名和密码应该有效 - 但不行。

auth.php: 应验证用户身份并在详细信息有效的情况下创建 session //登录永远不起作用

<?php
session_start();

$username = $_POST['username'];
$password = $_POST['password'];

if (strlen($username)<3 || strlen($password)<3) {
    header('Location: log_in.php5?error=1');
    die();
}

$username = mysql_real_escape_string($username);

function validateUser() {
    session_regenerate_id ();
    $_SESSION['valid'] = 1;
    $_SESSION['userid'] = $username;
}

include "../db_login.php5";
mysql_select_db("DB_NAME", $con);

$query = "SELECT password, salt
        FROM users
        WHERE username = '" . $username . "';";

$result = mysql_query($query);

$userData = mysql_fetch_assoc($result);
$count = mysql_num_rows($userData);

if ($count < 1) {
    header('Location: log_in.php5?error=1');
    die();
}

$salt = "";
$hashed_pass = "";

for ($x=0; $x<1; $x++) {
  $salt = $userData['salt'];
  $hashed_pass = $userData['password'];
}

$hash = hash('sha256', $salt . hash('sha256', $password));

mysql_close($con);

if ($hash != $hashed_pass) {
    header('Location: log_in.php5?error=1');
    die();
} else {
    validateUser();
}

header('Location: members.php5');
?>

register.php:应该获取用户名，用盐散列密码，将所有3存储到数据库//works

<?php
//retrieve our data from POST
$username = $_POST['username'];
$pass1 = $_POST['pass1'];
$pass2 = $_POST['pass2'];
if($pass1 != $pass2)
    header('Location: sign_up.php5');
if(strlen($username) > 30)
    header('Location: sign_up.php5');

$hash = hash('sha256', $pass1);

function createSalt(){
    $string = md5(uniqid(rand(), true));
    return substr($string, 0, 3);
}

$salt = createSalt();
$hash = hash('sha256', $salt . $hash);

include "../db_register.php5";
mysql_select_db("DB_NAME", $con);

//sanitize username
$username = mysql_real_escape_string($username);
$query = "INSERT INTO users (username, password, salt)
        VALUES ( '$username' , '$hash' , '$salt' );";
mysql_query($query);
mysql_close($con);

header('Location: log_in.php5');
?>

login.php 文件是一个简单的表单，它将数据发布到 auth.php；sign_up.php 文件也是一个简单的表单，它将用户数据发布到 register.php。

我的代码有什么问题，不允许我登录？

编辑:

所以我已经缩小了问题范围，因此 $username 变量从一开始似乎就是空白的？

输出:

Count: 
User: 
Query: SELECT * FROM `users` WHERE `username`='';

输出代码:

$query = "SELECT * 
FROM `users` 
WHERE `username`='".$username."';";

$result = mysql_query($query);

$userData = mysql_fetch_assoc($result);
$count = mysql_num_rows($userData);

if ($count < 1) {
    echo "Count: ".$count."<BR/>"
    . "User: " .$username ."<BR/>"
    . "Query: " .$query;
    //header('Location: log_in.php5?error=1,count='.$count.'user='.$username);
    //die();
}

$count 和 $username 不会打印在地址或 sql 查询中

编辑2:

*Jared* eventually found the problems which were two in number:
1) $username = mysql_real_escape_string($username); <-- required a db connection $con in my case
2) $count = mysql_num_rows($userData); <-- required to pass the $result instead.

谢谢大家!

Answer 1

这部分是怎么回事？

for ($x=0; $x<1; $x++) {
  $salt = $userData['salt'];
  $hashed_pass = $userData['password'];
}

对 $userData 进行 var_dump。

编辑

function validateUser($username) {
    session_regenerate_id ();
    $_SESSION['valid'] = 1;
    $_SESSION['userid'] = $username;
}

靠近底部:

if ($hash != $hashed_pass) {
    header('Location: log_in.php5?error=1');
    die();
} else {
    validateUser($username);
}