php登录问题(用户无法登录，用户可以使用别人的密码访问自己的账户)

Question

好的，这是我的问题，有些用户无法登录他们的帐户。他们正确输入了密码和用户名，但似乎不起作用。

其次，我注意到一些用户可以使用自己的密码而不是原始帐户的密码登录他们想要的任何帐户。

使用 MYSQL 和 PHP5。

/*Login script*/

if (isset($_POST['Submit'])) {

    $loginUserName = ($_POST['loginUserName']);
    $loginUserName = stripslashes($loginUserName);
    $loginUserName = strip_tags($loginUserName);
    $loginPassWord = ($_POST['loginPassWord']);
    $loginPassWord = stripslashes($loginPassWord);
    $loginPassWord = strip_tags($loginPassWord);
    $loginPassWord = md5($loginPassWord);

    $loginSubmitQuery = "SELECT username,password FROM users WHERE username = '". mysql_real_escape_string($loginUserName ."' and password = '". mysql_real_escape_string($loginPassWord) ."'"; 
    $loginResultQuery = mysql_query($loginSubmitQuery) or die ("Could not find loginUserName and/or loginPassWord");
    $loginResultQuery2 = mysql_fetch_array($loginResultQuery);

     if ($loginResultQuery2) {
        $sql = "SELECT * FROM users WHERE username='".$loginUserName."'";   
        $result = mysql_query($sql)or die('_'.mysql_error());
        while ($row = mysql_fetch_assoc($result)) {
            $_SESSION['player']['id']               = $row['id'];
            $_SESSION['player']['username']         = $row['username'];
            $_SESSION['player']['gamestatus']       = $row['gamestatus'];
            $_SESSION['player']['healthpoints']     = $row['healthpoints'];
            $_SESSION['player']['maxhealthpoints']  = $row['maxhealthpoints'];
            $_SESSION['player']['manapoints']       = $row['manapoints'];
            $_SESSION['player']['maxmanapoints']    = $row['maxmanapoints'];
            $_SESSION['player']['level']            = $row['characterlevel'];
            $_SESSION['player']['strength']         = $row['strength'];
            $_SESSION['player']['defence']          = $row['defence'];
            $_SESSION['player']['monsterid']        = $row['monsterid'];
            $_SESSION['player']['decivers']         = $row['decivers'];
            $_SESSION['player']['experience']       = $row['experience'];
            $_SESSION['player']['nextlevel']        = $row['nextlevel'];
            $_SESSION['player']['inbattle']         = $row['inbattle'];
            $_SESSION['player']['monsterlevel']     = $row['monsterlevel'];
            $_SESSION['player']['monsterid']        = $row['monsterid'];

        }

        echo '<div id="loginaccess"><a href="home.php">[Success Click Here to Login]</a></div>';

    } else {

        echo '<div id="loginaccess">Invalid username or password.</div>';

    }
}
                ?>
            <form id="login" action="" method="POST">
                    <div id="uname" class="formfloat"><p><label for="loginUserName">Username:</label>
                    <input type="text" id="loginUserName" name="loginUserName" value="" class="formfield" tabindex="1" size="15" maxlength="20" /></div></p>
                    <div id="pword" class="formfloat"><p><label for="loginPassWord">Password: </label>
                    <input type="password" id="loginPassWord" name="loginPassWord" value="" class="formfield" tabindex="2" size="15" maxlength="20" /></div></p>
                    <div class="formbreak"></div><br />
                    <input id="loginsubmit" type="submit" value="Login" name="Submit" tabindex="3" >
            </form>
            </div>
        </div>
        <div id="sidebarRight"><!-- sidebarRight div start -->
        </div>

Answer 1

当您验证密码时，您的 SQL 查询似乎缺少一个子句。如果给定的用户名存在于数据库中，WHERE username = '$loginUserName' AND '$loginPassWord' 将评估为 true，并且 $loginPassWord 的值评估为 true(因为你没有将它与任何东西进行比较)。

此外，在数据库查询中使用它之前，您应该转义从用户那里获得的输入，使用类似于 mysql_real_escape_string 的东西，为了防止SQL Injection攻击。

综合起来，我会用类似的内容替换您的查询:

$loginSubmitQuery = "SELECT username, password
  FROM users
  WHERE username = '" . mysql_real_escape_string($loginUserName) . "'
    AND password = '" . mysql_real_escape_string($loginPassWord) . "'";