0

我目前正在制作的网站上的用户登录功能一直存在一些问题。我在 index.php 页面上创建了一个登录表单表，并告诉它如果登录有效则转到 userindex.php，如果无效则转到 loginfail.html。然后使用dreamweavers页面授权工具我保护了页面userindex.php并告诉它将未经授权的用户重定向回index.php

我遇到的问题是，一旦有人输入正确的用户名和密码详细信息并按下提交，他们就会被发送到 index.php 。就好像它们被发送到 userindex.php 然后未经授权。但是，登录后键入 userindex.php 的地址会显示包含用户信息的完整页面，就好像他们已被批准一样。

这是有关此用户登录问题的两个页面的代码

索引.php

    <?php
        // *** Validate request to login to this site.
        if (!isset($_SESSION)) {
          session_start();
        }

        $loginFormAction = $_SERVER['PHP_SELF'];
        if (isset($_GET['accesscheck'])) {
          $_SESSION['PrevUrl'] = $_GET['accesscheck'];
        }

        if (isset($_POST['UsernmaeBox'])) {
          $loginUsername=$_POST['UsernmaeBox'];
          $password=$_POST['PasswordBox'];
          $MM_fldUserAuthorization = "";
          $MM_redirectLoginSuccess = "Userindex.php";
          $MM_redirectLoginFailed = "loginfail.html";
          $MM_redirecttoReferrer = false;
          mysql_select_db($database_dbname, $dbname);

          $LoginRS__query=sprintf("SELECT Username, Password FROM SGUsers WHERE Username=%s AND Password=%s",
            GetSQLValueString($loginUsername, "text"), GetSQLValueString($password, "text")); 

          $LoginRS = mysql_query($LoginRS__query, $Newsograph) or die(mysql_error());
          $loginFoundUser = mysql_num_rows($LoginRS);
          if ($loginFoundUser) {
             $loginStrGroup = "";

            if (PHP_VERSION >= 5.1) {session_regenerate_id(true);} else {session_regenerate_id();}
            //declare two session variables and assign them
            $_SESSION['MM_Username'] = $loginUsername;
            $_SESSION['MM_UserGroup'] = $loginStrGroup;       

            if (isset($_SESSION['PrevUrl']) && false) {
              $MM_redirectLoginSuccess = $_SESSION['PrevUrl'];  
            }
            header("Location: " . $MM_redirectLoginSucenter code here      if (strpos($MM_restrictGoTo, "?")) $MM_qsChar = "&";
  if (isset($_SERVER['QUERY_STRING']) && strlen($_SERVER['QUERY_STRING']) > 0) 
  $MM_referrer .= "?" . $_SERVER['QUERY_STRING'];
  $MM_restrictGoTo = $MM_restrictGoTo. $MM_qsChar . "accesscheck=" . urlencode($MM_referrer);
  header("Location: ". $MM_restrictGoTo); 
  exit;
}
?>

用户索引.php

<?php
if (!isset($_SESSION)) {
  session_start();
}
$MM_authorizedUsers = "";
$MM_donotCheckaccess = "true";

// *** Restrict Access To Page: Grant or deny access to this page
function isAuthorized($strUsers, $strGroups, $UserName, $UserGroup) { 
  // For security, start by assuming the visitor is NOT authorized. 
  $isValid = False; 

  // When a visitor has logged into this site, the Session variable MM_Username set equal to their username. 
  // Therefore, we know that a user is NOT logged in if that Session variable is blank. 
  if (!empty($UserName)) { 
    // Besides being logged in, you may restrict access to only certain users based on an ID established when they login. 
    // Parse the strings into arrays. 
    $arrUsers = Explode(",", $strUsers); 
    $arrGroups = Explode(",", $strGroups); 
    if (in_array($UserName, $arrUsers)) { 
      $isValid = true; 
    } 
    // Or, you may restrict access to only certain users based on their username. 
    if (in_array($UserGroup, $arrGroups)) { 
      $isValid = true; 
    } 
    if (($strUsers == "") && true) { 
      $isValid = true; 
    } 
  } 
  return $isValid; 
}

$MM_restrictGoTo = "index.php";
if (!((isset($_SESSION['MM_Username'])) && (isAuthorized("",$MM_authorizedUsers, $_SESSION['MM_Username'], $_SESSION['MM_UserGroup'])))) {   
  $MM_qsChar = "?";
  $MM_referrer = $_SERVER['PHP_SELF'];
  if (strpos($MM_restrictGoTo, "?")) $MM_qsChar = "&";
  if (isset($_SERVER['QUERY_STRING']) && strlen($_SERVER['QUERY_STRING']) > 0) 
  $MM_referrer .= "?" . $_SERVER['QUERY_STRING'];
  $MM_restrictGoTo = $MM_restrictGoTo. $MM_qsChar . "accesscheck=" . urlencode($MM_referrer);
  header("Location: ". $MM_restrictGoTo); 
  exit;
}
?>

非常感谢您的阅读。我花了很长时间试图弄明白，没想到 Dreamweaver 会让它变得如此混乱！谢谢。

4

1 回答 1

0

这里有两个可能的错别字。你有 UsernmaeBox 而不是 UsernameBox。当然，除非你打算这样做。

if (isset($_POST['UsernmaeBox'])) {
      $loginUsername=$_POST['UsernmaeBox'];
于 2013-08-18T18:01:58.467 回答