-3

我正在制作一个多合一的注册/登录脚本,如果未设置 $_POST,它将首先显示注册表单。如果是,但未填写必填字段,它会再次重定向到页面,重新设置 $_POST。如果填写了所有字段,那么如果设置了提交按钮的名称 $_POST["login"],则表单确认登录并设置一个文本块,这是一个将用户重定向到他们的购物篮的页面或回到商店。如果提交按钮 $_POST["register"] 被设置,那么用户想要注册并且插入查询被构建并提交。如果此查询未返回任何受影响的行,则脚本会检查用户是否已注册。如果是这样,请让他们登录并按照正常登录向他们显示重定向页面。否则,如果脚本返回 1 行受影响,

如果您点击登录,则登录有效,如果您错过了必填字段,则重定向有效,但仅此而已。我看不到问题,也没有收到任何错误 - 如果出现其他情况,我只会看到一个空白屏幕。这是一大段代码,恐怕......

    <?php
if(!$_POST) {
  //hasn't seen the registration form
  //display registration form
      $display_block = "
      <form method=\"POST\" action=\"".$_SERVER["PHP_SELF"]."\">
      <p>Please fill in the registration field (required fields marked with <span class=\"req\"><</span>)<br />
      First name: <input type=\"text\" name=\"f_name\" size=\"25\" maxlength=\"50\" /><span class=\"req\"><</span><br />
      Last name: <input type=\"text\" name=\"l_name\" size=\"25\" maxlength=\"50\" /><span class=\"req\"><</span><br />
      Address: <input type=\"text\" name=\"address\" size=\"50\" maxlength=\"150\" /><br />
      Town: <input type=\"text\" name=\"town\" size=\"50\" maxlength=\"150\" /><br />
      City: <input type=\"text\" name=\"city\" size=\"50\" maxlength=\"150\" /><br />
      Post Code: <input type=\"text\" name=\"postcode\" size=\"10\" maxlength=\"10\" /><br />
      Username: <input type=\"text\" name=\"username\" size=\"25\" maxlength=\"25\" /><span class=\"req\"><</span><br />
      Confirm username: <input type=\"text\" name=\"usernameConfirm\" size=\"25\" maxlength=\"25\" /><span class=\"req\"><</span><br />
      Password: <input type=\"password\" name=\"password\" size=\"25\" maxlength=\"25\" /><span class=\"req\"><</span><br />
      Confirm password: <input type=\"password\" name=\"passwordConfirm\" size=\"25\" maxlength=\"25\" /><span class=\"req\"><</span><br />
      <br />
      <input type=\"submit\" name=\"register\" value=\"Register\" /><br /><br />
      Already a member? <input type=\"submit\" name=\"login\" value=\"Login\" />
      </p>";

} else if ((!isset($_POST["username"])) || (!isset($_POST["usernameConfirm"])) || (!isset($_POST["password"])) || (!isset($_POST["passwordConfirm"]))) {
  //hasn't filled out all the fields
  header("Location: ".$_SERVER["PHP_SELF"]."");
  exit;
} else if($_POST["login"]) {

  //user is logging in, so connect to server and select database, check they are registered and their details are right
          $mysqli = mysqli_connect(hostname,username,pass,dbname);

    //create and issue the query
    $sql = "SELECT f_name, l_name FROM auth_users WHERE username='".$_POST["username"]."' AND password=PASSWORD('".$_POST["password"]."')";
    $sql_res =mysqli_query($mysqli, $sql) or die(mysqli_error($mysqli));

    //get the number of rows in the result set; should be 1 if a match
    if(mysqli_num_rows($sql_res) == 1) {
      //if authorized, get the values of f_name, l_name
      while($info = mysqli_fetch_array($sql_res)) {
        $f_name = stripslashes($info["f_name"]);
        $l_name = stripslashes($info["l_name"]);
      }
      //set authorization cookie
      setcookie("auth", "1", 0, "/", "sinaesthesia.co.uk", 0);

      //create display string
      $display_block = "<p>".$f_name." ".$l_name." is authorized.</p>
      <p>You are now logged in.</p>
      <a href=\"basket.php5\">View Basket</a> | <a href=\"home.php5\">Continue Shopping</a>";

    } else if($_POST["register"]) {

      //connect to db and issue registration query
          $mysqli = mysqli_connect(hostname,username,pass,dbname);

          $register_sql = "INSERT INTO aromaMaster (username, password, date_registered) VALUES ('".$_POST["username"]."',PASSWORD('".$_POST["password"]."'),now())";
          $register_res = mysqli_query($mysqli, $register_sql) or die(mysqli_error($mysqli));

          if (mysqli_num_rows($register_res) != 1) {
            //registration failed - perhaps duplicate account

            $check_sql = "SELECT username, password FROM aromaMaster WHERE username='".$_POST["username"]."' AND password=PASSWORD('".$_POST["password"]."')";
            $check_res = mysqli_query($mysqli, $check_sql) or die(mysqli_error($mysqli));

            if(mysqli_num_rows($check_res) == 1) {
              //already a member

              //set cookie
                    //set authorization cookie
      setcookie("auth", "1", 0, "/", "sinaesthesia.co.uk", 0);

              $display_block = "
              <p>You are already registered.</p>
      <a href=\"basket.php5\">View Basket</a> | <a href=\"home.php5\">Continue Shopping</a>";
            }
          } else {
            //success
            $display_block = "
            <p>You are registered!</p>
      <a href=\"basket.php5\">View Basket</a> | <a href=\"home.php5\">Continue Shopping</a>";
          }


    }
    mysqli_close($mysqli);
    }
?>
<html>
<head>
<title>Login / Register</title>
</head>
<body>
<?php echo "$display_block"; ?>
</body>
</html>
4

1 回答 1

1

您不想将来自用户的字符串直接放入您的查询中。 http://php.net/manual/en/security.database.sql-injection.php

于 2009-08-14T00:32:52.530 回答