PHP登录和MySQL查询

更新时间：2023-12-03 20:39:10

您的脚本存在一些问题.

首先，首先使用PDO连接到数据库，然后使用mysql_*函数(不建议使用，请坚持使用PDO !!!).另外，您不能正确地转义数据，并且您的代码可能容易受到SQL注入的攻击.

第二，您正在使用的查询...不好.

// this is not checking for either the user input data !!!
$qry = "SELECT login FROM users WHERE login = 'admin'";

您的验证码应如下所示:

$ps = $bdd->prepare("SELECT COUNT(*) FROM users WHERE login = :login AND pass = :password");
$params = array("login" => $_POST['login'], "password" => $_POST['password']);
$ps->execute($params);

$status = (bool) $ps->fetchColumn(0);

if ($status) {
    // login successful
} else {
    // login failed
}

在 PDO 和准备好的语句 (它们会自动转义您的数据，因此您不必不必).

注意:

如果您在以后的代码中不使用准备好的语句，请记住始终避免用户输入以及几乎所有其他信息源.

I'm having some trouble with my login feature. I've been searching for hours and I could'nt find any problem. I hope you guys will help me. I want to get users' login and check if it exists in my DB. Problem is it keeps returning me : "Password was probably incorrect!". I tried an "echo ($count)", it doesn't return anything. Same thing for "echo($result)".

I'm pretty lost right, I can't understand why this doesn't work...

PS : I'm french so you might see some french words.

Here's my login form :

<?php
   session_start();
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>  
    <meta charset="utf-8" />
    <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
    <title>Applications</title>
    <!--Chargement des feuilles de style-->
    <link rel="stylesheet" type="text/css" href="./css/style.css" />
    <link rel="stylesheet" type="text/css" href="./css/styleLogin.css" />
    <script src="./js/login/modernizr.custom.63321.js"></script>    
</head>
<body>
    <div class="container">


        <header></header>

        <section class="main">
            <form class="form-2" id="loginForm" action="./controller/checkLogin.php" method="post">
                <h1><span class="log-in">Se connecter</span></h1>
                <p class="float">
                    <label for="loginLabel"><i class="icon-user"></i>Nom d'utilisateur</label>
                    <input type="text" name="login" id="login">
                </p>
                <p class="float">
                    <label for="passwordLabel"><i class="icon-lock"></i>Mot de passe</label>
                    <input type="password" name="password" class="showpassword" id="password">
                </p>
                <p class="clearfix">    
                    <input type="submit" name="submit" value="Se connecter">
                    <input type="button" name="submitVisit" value="Accès utilisateur">
                </p>
            </form>
        </section>

    </div>
</body>

And here's my checkLogin.php :

<?php

session_start();

try {           
    $bdd = new PDO('mysql:host=localhost;dbname=stage','root','');
  }
  catch (Exception $e){ //en cas d'erreur de connexion, afficher le message           
    die('Erreur : '.$e->getMessage());
  }

if(isset($_POST['submit'])){
    // username and password sent from form 
    $login = $_POST['login'];
    $pass = $_POST['password'];

    $qry = "SELECT login FROM users WHERE login = 'admin'";
    $result = mysql_query($qry);


    // Mysql_num_row is counting table row
    $count = mysql_num_rows($result);

    if($count == 0){
        die("Password was probably incorrect!");
    }
    // If result matched $myusername and $mypassword, table row must be 1 row
    elseif($count == 1){

        // Register $myusername, $mypassword and redirect to file "login_success.php"
        $_SESSION['login'] = $login;
        header("location: ./login_success.php");
    }

    else {
        echo "Wrong Username or Password";
    }
}

mysql_close($bdd);
?>

I want to log in with this couple : admin/admin.

Thank you in advance.

There are a few problems with your script.

First off, you start by using PDO to connect to the database, then you use mysql_* functions (which are deprecated, stick to PDO !!!). Plus, you are not properly escaping your data, and your code is potentially vulnerable to SQL injection.

Secondly, the query you are using is ... not good.

// this is not checking for either the user input data !!!
$qry = "SELECT login FROM users WHERE login = 'admin'";

Your verification code should be something like this:

$ps = $bdd->prepare("SELECT COUNT(*) FROM users WHERE login = :login AND pass = :password");
$params = array("login" => $_POST['login'], "password" => $_POST['password']);
$ps->execute($params);

$status = (bool) $ps->fetchColumn(0);

if ($status) {
    // login successful
} else {
    // login failed
}

Read up on PDO and prepared statements (they automatically escape your data, so you don't have to).

Note:

If you don't use prepared statements in future code, remember to always escape input from users and pretty much any other source of information.

上一篇 : ：与Android的饼干PHP登录

PHP登录和MySQL查询

相关阅读

推荐文章