0

我有一个删除帐户页面，允许用户在检查密码是否正确后删除他们的帐户，但问题是当用户输入错误密码时，系统会显示密码不正确的错误消息。当用户输入正确的密码时，系统不会显示任何消息通知用户。谁能帮我？

删除帐户.php

<?php 
session_start();
$msgToUser="";
if(@!$_SESSION['user_id'])
{
    $msgToUser= '<br /><br /><font color = "#FF000">Only registered users can delete their account</font><p><a href = "register.php">Join Here</a></p>';
    exit();
}
$id = $_SESSION['user_id'];

if(isset($_POST['delete']))
{


        $del_acct_pass = $_POST['del_account_pass'];
         require_once('include/connect.php'); 
        $check_pass = mysql_query("SELECT password FROM user WHERE password = '$del_acct_pass' AND user_id ='$id'")or die(mysql_error());
        $check_pass_num = mysql_num_rows($check_pass);
        if($check_pass_num>0)
        {
        /*$sql = mysql_query("SELECT * FROM user  WHERE user_id = '$id'")or die(mysql_error());
        $pass_check_num = mysql_num_rows($sql);*/


            $pic1=("members/$id/image01.jpg");
            if(file_exists($pic1))
            { 
                  unlink($pic1);

            }

            $dir = "members/$id";
            rmdir($dir);

            $sqltable1 = mysql_query("DELETE FROM user WHERE user_id ='$id'")or die(mysql_error());
            $sqltable1 = mysql_query("DELETE FROM blabing WHERE u_id ='$id'")or die(mysql_error());
            $msgToUser="<h3 style='color:#99FF33'>YOUR Account Has Been Deleted!!!</h3>";
            session_destroy();



        }
        $msgToUser = "<h3 style='color:#CC0000'>YOU must Write the correct Password</h3>";

}



?>
  <table width="70%" align="center" cellpadding="6">
          <form action="delete_account.php" method="post" name="delete_form" >
            <tr>
              <td bgcolor="#CCCCCC">Delete Your Account </td>
            </tr>
            <tr>
              <td>Please enter Your current Password to proceed with account deletion</td>
            </tr>
            <tr>
              <td><input type="password" name="del_account_pass" id="del_account_pass" /></td>
            </tr>
            <tr>

              <td><input type="submit" name="delete" id="delete" value="Delete Account" /></td>
            </tr>
            <tr>
            <td><?php echo $msgToUser; ?></td>
            </tr>
            </form>
          </table>
4

1 回答 1

1

您始终将 $msgToUser 设置为关于密码不正确的消息。

即使删除帐户，它也会运行。

您可能希望在 Else 子句中使用它

} else {
    $msgToUser = "<h3 style='color:#CC0000'>YOU must Write the correct Password</h3>";
}

顺便说一句，您需要阅读安全性，您的代码容易受到 SQL 注入的攻击。

于 2013-05-12T14:02:06.857 回答