php - 使用 PHP 和 MySQL 进行密码保护

Question

我正在创建一个包含登录和注册功能的网络应用程序。有两个主要用户:客户端和 1 个管理员。到目前为止，我已经成功地为客户端创建了一个链接到 mySQL 数据库的注册页面。

以及客户端和管理员的登录页面。登录后，客户端或管理员将被重定向到各自的仪表板。

我现在面临的问题是 - 如果任何访问网站的人在培训师仪表板的 URL 中输入内容，他们将被授予完全访问权限和管理权限。我希望显示一条消息，内容为“请登录”

这是我当前在“login.php”文件中使用的代码片段:

   <?php
if (!isset($_POST['submit'])){
?>
<!-- The HTML login form -->
    <center><form action="<?=$_SERVER['PHP_SELF']?>" method="post">
        <div class="form-group">
                <input type="text" name="username" id="username" class="form-control input-lg" placeholder="Username" tabindex="3">
            </div>
        <div class="form-group">
                 <input type="password" name="password" id="password" class="form-control input-lg" placeholder="Password" tabindex="5">
            </div>

        <br /> <br /><input type="submit" name="submit" class="btn btn-success btn-block btn-lg" value="Login" /> </center>
    </form>
<?php
} else {
    require_once("db_const.php");
    $mysqli = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);
    # check connection
    if ($mysqli->connect_errno) {
        echo "<p>MySQL error no {$mysqli->connect_errno} : {$mysqli->connect_error}</p>";
        exit();
    }

    $username = $_POST['username'];
    $password = $_POST['password'];

    $tusername = $_POST['username'];
    $tpassword = $_POST['password'];

    $sql = "SELECT * from client WHERE Client_username LIKE '{$username}' AND Client_password LIKE '{$password}' LIMIT 1";
    $result = $mysqli->query($sql);
    if (!$result->num_rows == 1) {
        echo "<p>Invalid username/password combination</p>";
    } else {
        header('location:client_dash.html?msg=success');
    }

    $sql = "SELECT * from trainer WHERE trainer_username LIKE '{$tusername}' AND trainer_password LIKE '{$tpassword}' LIMIT 1";
    $result = $mysqli->query($sql);
    if (!$result->num_rows == 1) {
        echo "<p>Invalid username/password combination</p>";
    } else {
        header('location:trainer_dash.php?msg=success');
    }
}

?>

Answer 1

您可以使用SESSION变量来做到这一点

您的代码将更改为..

<?php  
    ob_start();
    session_start();

    require_once("db_const.php");
    $mysqli = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);

    if ($mysqli->connect_errno) {
    echo "<p>MySQL error no {$mysqli->connect_errno} : {$mysqli->connect_error}</p>";
        exit();
    }

    $username = $_POST['username'];
    $password = $_POST['password'];

    $tusername = $_POST['username'];
    $tpassword = $_POST['password'];

    $sql = "SELECT * from client WHERE Client_username LIKE {$username}' AND Client_password LIKE '{$password}' LIMIT 1";
    $result = $mysqli->query($sql);
    if (!$result->num_rows == 1) 
    {
        echo "<p>Invalid username/password combination</p>";
    }
     else 
    {
        $_SESSION['username']=$username;
        header('location:client_dash.html?msg=success');
    }

    $sql = "SELECT * from trainer WHERE trainer_username LIKE '{$tusername}' AND trainer_password LIKE '{$tpassword}' LIMIT 1";
    $result = $mysqli->query($sql);
    if (!$result->num_rows == 1) 
    {
        echo "<p>Invalid username/password combination</p>";
    }
     else
    {
        $_SESSION['tusername']=$tusername;
        header('location:trainer_dash.php?msg=success');
    }

}

？>

如果是客户端，则可以在仪表板上执行此操作

<?php 
    ob_start();
    session_start();
    if(!isset($_SESSION['username']))
    {
        die('Please log in first');
    }
    unset($_SESSION['username']);

    */rest code*/

?>

对于trainer的仪表板也是如此

<?php 
    ob_start();
    session_start();
    if(!isset($_SESSION['tusername']))
    {
        die('Please log in first');
    }
    unset($_SESSION['tusername']);

    */rest code*/

?> 

您正在取消设置 session 变量，因为如果您不这样做，那么它只会在第一次起作用，因为之后您的 session 将永久设置因此你必须取消设置它们