php - 如何从数据库在 php 中进行多重验证登录

Question

我想在查询中使用验证登录，例如

"select account from login where account='active'" 

检查状态后 active然后他/她将能够登录到系统。我正在尝试使用下面提到的代码，但它不起作用.....请帮助我!

//login.php
<?php
session_start(); // Starting Session
$error=''; // Variable To Store Error Message
if (isset($_POST['sbm'])) {
if (empty($_POST['email']) || empty($_POST['password'])) {
$error = "Username or Password is invalid";
}
else
{
// Define $username and $password
$username=$_POST['email'];
$password=$_POST['password'];
// Establishing Connection with Server by passing server_name, user_id and password as a parameter
$connection = mysql_connect("localhost", "root", "");
// To protect MySQL injection for Security purpose
$username = stripslashes($username);
$password = stripslashes($password);
$username = mysql_real_escape_string($username);
$password = mysql_real_escape_string($password);
// Selecting Database
$db = mysql_select_db("company", $connection);
$valid=mysql_query("select account from login where account='active'",$connection);
$acc=mysql_fetch_assoc($valid);
echo $acc['account'];
if($valid==1){
// SQL query to fetch information of registerd users and finds user match.
$query = mysql_query("select * from login where password='$password' AND email='$username'", $connection);
$rows = mysql_num_rows($query);
if ($rows == 1) {
$_SESSION['login_user']=$username; // Initializing Session
header("location: profile.php"); // Redirecting To Other Page
} else {
$error = "Username or Password is invalid";
}
mysql_close($connection); // Closing Connection
}
}
}
?>

Answer 1

这个查询

select account from login where account='active'

将返回所有事件帐户。您只对当前用户的帐户是否处于事件状态感兴趣，因此您应该将结果限制为该用户

//guarantees that user will not be logged in until all checks are passed
unset($_SESSION['login_user']);    
$success = false; //set to true once all checks are passed
$sql = "SELECT * from login WHERE email='$email'";
$result = mysql_query($sql,$connection);
if($result===false){ //DB error. Probably a bad query or wrong DB credentials
    // user should not see the exact error, but you can get it from mysql_error()
    $error = "Server error: contact the admin";
}
elseif(mysql_num_rows($result)===0){//no account found
    $error = "The email $email is unknown";
}
else{// The account exists; you can run further checks  
    $account_row = mysql_fetch_assoc($result);

    if($account_row['account']!== 'active'){
        $error = "Account $email is not active";
    }
    elseif($account_row['password']!==$password){
        $error = "Password is incorrect"
    }
    else{
        $success = true; //all checks passed
    }
}
 mysql_close($connection);

现在你完成了检查。根据登录是否成功决定做什么

if($success){
     $_SESSION['login_user']=$username;
     header("location: profile.php");
}else{
    //login failed. Error is in $error        
}

3 最后的注释:

你不应该使用 mysql_职能。它们已被弃用。改为学习 MySQLi 或 PDO

您的密码没有经过哈希处理。您不应该以明文形式存储您的密码! See this guide

尽管我在错误消息中将“未知电子邮件”与“密码错误”分开，但您不应该让用户区分。如果错误是这两个之一，只需说“错误的用户名或密码”。