PHP登录问题；未知

Question

我正在进行 PHP 登录，并且之前可以正常工作，但我尝试使用户名功能不区分大小写，但此后代码一直无法正常工作。我删除了我添加的所有内容，以尝试使其不区分大小写，即 strtolower()。页面上显示的只是“请输入用户名和密码”。但我有一个 html 文件，应该弹出并显示登录信息。代码如下(我在mysql连接区取出了个人数据库信息):

<?php

session_start();

$username = $_POST["username"];
$password = $_POST["password"];

if ($username&&$password)
{
    $connect = mysql_connect("","","") or die("No Database");
    mysql_select_db("") or die("Couldn't find database");

    $query = mysql_query("SELECT * FROM login WHERE     username='$username'");

$numrows = mysql_num_rows($query);

if($numrows !=0)

{
    while ($row = mysql_fetch_assoc($query))
    {
        $dbusername = $row['username'];
        $dbpassword = $row['password'];
    }
    if ($username==$dbusername&&$password==$dbpassword)
    {
        echo "Login succesful. <a href='/memberarea.php'>Members</a>";
        $_session['username']=$dbusername;

    }
    else
        echo "Incorrect Password";
}

else
    die("Username does not exist");
}
else
    die("Please enter a username and password.");

?> 

Answer 1

我已将 mysql_real_escape_string() 放在您的帖子值周围以防止 SQL 注入(inject)

mysqli 也是连接 mysql 数据库的最新方法，但我还没有将其添加到您的代码中:

session_start();

$username = mysql_real_escape_string($_POST["username"]);
$password = mysql_real_escape_string($_POST["password"]);

if ($username&&$password)
{
    $connect = mysql_connect("","","") or die("No Database");
    mysql_select_db("") or die("Couldn't find database");

    $query = mysql_query("SELECT * FROM login");

    while ($row = mysql_fetch_assoc($query))
    {
        $dbusername = $row['username'];
        $dbpassword = $row['password'];

    if ($username == $dbusername && $password == $dbpassword)
    {
        echo "Login succesful. <a href='/memberarea.php'>Members</a>";
        $_session['username']=$dbusername;

    }
    }

    else {
        echo "Incorrect Password";
    }
}