我的登录屏幕登录，即使输入不正确

当我填写某些内容时，我的后端登录屏幕会登录，字面意思是某些内容。这没有意义，我连接到我的数据库，我检查表单是否已提交，然后我执行我的查询，我什至有一个会话来检查我是否登录。也许是我使用的是 POST 而不是 GET？老实说，我不知道。我做错了什么？

<?php
if( !isset( $_SESSION ) ) session_start();
$msg='';
*db information*
$conn = new mysqli( $dbhost, $dbuser, $dbpass, $dbname );
if ( $conn->connect_error ) die("Connection failed");

if( isset( $_POST['submit'] ) ) {
$uname = $_POST['username'];
$wwoord = $_POST['wachtwoord'];
$query = "SELECT * FROM Medewerkers WHERE medewerker_username='$uname' && medewerker_password='$wwoord'";
$result = $conn->query( $query );
if( $result ) {
    $_SESSION['ingelogd'] = true;
    header("location: adminpanel.php");
} else {
    $msg="Inloggegevens incorrect.";
}
$conn->close();
}
?>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Admin login</title>
<link rel="stylesheet" type="text/css" href="tables.css">
</head>
<body>
<div id="content">
<ul>
    <li><a href="index.php">Admin panel</a></li>
</ul>
<h1>Admin login</h1>
<?php
echo $msg;
?>
<form role="form" method="post" action="index.php" class="contactForm">
    <table>
        <tr>
            <td><label for="username">Username</label></td>
            <td><input type="text" name="username" class="" id="username">  <br><br></td>
        </tr>
        <tr>
            <td><label for="wachtwoord">Wachtwoord</label></td>
            <td><input type="password" name="wachtwoord" class="" id="wachtwoord"><br><br></td>
        </tr>
        <tr>
            <td><button type="submit" name="submit"     class="button">Inloggen</button><br></td>
        </tr>
    </table>
</form>
</div>
</body>
</html>

我认为您需要在执行 sql 后在 php 中进行检查，以确保您返回了有效的记录集而不是布尔$result。

<?php
    if( !isset( $_SESSION ) ) session_start();
    if( isset( $_SESSION['ingelogd'] ) ) header("location: adminpanel.php");
    $msg='';
    $conn = new mysqli( $dbhost, $dbuser, $dbpass, $dbname );
    if ( $conn->connect_error ) die("Connection failed");

    if( isset( $_POST['submit'] ) ) {
        $uname = $_POST['username'];
        $wwoord = $_POST['wachtwoord'];
        $query = "SELECT * FROM `Medewerkers` WHERE `medewerker_username`='$uname' and `medewerker_password`='$wwoord' limit 1";
        $result = $conn->query( $query );
        if( $result ) {
            /* check that there is a valid recordset with exactly 1 record */
            if( $result->num_rows==1 ) {
                $_SESSION['ingelogd'] = true;
                header("location: adminpanel.php");
            }
            $msg='login failed';
        } else {
            $msg="Inloggegevens incorrect.";
        }
        $conn->close();
    }
?>

<?php
    /*
        if sql injection is a concern ( which it is ) then rather than embedding
        variables directly within the sql it is better to utilise prepared statements.
    */

    session_start();
    if( isset( $_SESSION['ingelogd'] ) ) header("location: adminpanel.php");
    $msg='';
    $conn = new mysqli( $dbhost, $dbuser, $dbpass, $dbname );
    if ( $conn->connect_error ) die("Connection failed");

    if( isset( $_POST['submit'] ) ) {
        $uname = $_POST['username'];
        $wwoord = $_POST['wachtwoord'];
        /* to avoid sql injection use prepared statements - add ? as placeholders for variables */
        $sql='select * from `medewerkers` where `medewerker_username`=? and `medewerker_password`=? limit 1';
        /* prepare the sql statement for execution */
        $stmt=$conn->prepare( $sql );
        /* If there is a problem preparing the statement it will return false */
        if( $stmt ) {
            /* assign variables to the placeholders */
            $stmt->bind_param( 'ss', $uname, $wwoord );
            /* execute the query */
            $result=$stmt->execute();
            /* The statement must have executed successfully, test recordset next */
            if( $result ) {
                /* store recordset so we can use access other functions / properties */
                $stmt->store_result();
                /* check that there is a valid recordset with exactly 1 record */
                if( $stmt->num_rows==1 ) {
                    /* we have a valid logon - one record retrieved */
                    $conn->close();
                    $_SESSION['ingelogd'] = true;
                    header("location: adminpanel.php");
                }
                $msg='login failed';
            } else {
                $msg="Inloggegevens incorrect.";
            }
            $conn->close();
        }
    }
?>

您只检查查询是否正常工作，而不检查它是否返回行。

而不是：

//...
$result = $conn->query( $query );
if( $result ) {
    $_SESSION['ingelogd'] = true;
//...

这样做：

//...
$result = $conn->query( $query );
if($result->num_rows == 1) {
    $_SESSION['ingelogd'] = true;
//...

当然，您的代码中还有其他需要改进的地方，例如 SQL 注入部分，您可以在其中获取 POST 数据而无需转义它，但我专注于您的确切问题。

相关内容

最新更新

热门标签：