-4

我正在尝试使用 index.html、login.js 和 login.php 创建登录。

索引.html

<!DOCTYPE HTML>
<html>
    <head>
    <link rel="stylesheet" type="text/css" href="../css/login.css">
    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
    <script src="http://ajax.googleapis.com/ajax/libs/jquery/1/jquery.min.js"></script>
    <script src="../javascript/login.js" type="text/javascript"></script>
    <script src="../javascript/engine.js"></script>
    </head>
    <body>
        <form name="loginForm" autocomplete="off">
            <table align=center>
            <tr><td colspan=2 bgcolor=#87C9FF><center><h2>Login</h2></center></td></tr>
                <tr><td><label for="username">Username:</label></td><td><input id="username" name="username" pattern="[a-zA-Z0-9]{3,3}" title="Minmimum 3 letters or numbers." required></td></tr>
                <tr><td><label for="password">Password:</label></td><td><input id="password" name="password" type="password" pattern=".{8,8}" title="Minmimum 8 letters or numbers." required></td></tr>
                <tr><td colspan=2><center><input type="submit" class="btn" value="Login" onClick="handleLogin(this.form)"></center></td></tr>
            </table>
        </form>
        <br/>
        <br/>
        <div name="Details" class="Details" id="Details></div>
        <br/>
    <?php include 'footer.php'; ?>
    </body>
<html>

登录.js

    jQuery(document).ready(
    function () {
        document.getElementById('username').focus().focus();
    }
);

function handleLogin(frm){
    var username = document.getElementById('username').value;
    var password = document.getElementById('password').value;
alert('hello');
    $.ajax({
            type: 'POST',
            url: 'login.php',
            data: {un: username, pw: password},
            dataType: 'json',
            cache: false,
            success: function(result) {
                validate = result;
                            alert("Goodbye");
            }   ,
    });
}

登录.php

<?php

    $username = $_POST["un"];
    $password = $_POST["pw"];
    $username = strtoupper($username);
    $password = strtoupper($password);

    $file_handle = fopen("phplog.txt", "w");
    $file_contents = "Username:" . $username . "\r\nPassword:" . $password . "\r\n";

    # This section will open a connection to the existing backup server and get the last ith_rid used.
    # It will then store that ith_rid to be used later and then close the database connection 
    $mysqlconn = new mysqli('localhost','username','password', 'table');
    if ($mysqlconn->connect_errno) {
        echo "Failed to connect to MySQL: (" . $mysqlconn->connect_errno . ") " . $mysqlconn->connect_error;
    }

    $res = $mysqlconn->query("SELECT opr, password FROM us_f WHERE opr='" . $username ."' GROUP BY opr, password ORDER BY opr DESC");
    if (!$res) {                                            ##If there is an error running query, display it to the screen.
        echo "Error: $mysqlconn->error \n";
    }
    $num_rows = $res -> num_rows;
    $file_contents .= $num_rows . "\r\n";
    $file_contents .= "SELECT opr, password FROM us_f WHERE opr='" . $username ."' GROUP BY opr, password ORDER BY opr DESC\r\n";


    if ($num_rows > 0){
        $result = 1;
        fwrite($file_handle, $file_contents);
        fclose($file_handle);
        echo json_encode($result);
    }
    if ($num_rows == 0){
        $result = 0;
        fwrite($file_handle, $file_contents);
        fclose($file_handle);
        echo json_encode($result);
    }
    fwrite($file_handle, $file_contents);
    fclose($file_handle);
?>

我已经使用 GET 而不是 POST 并通过 URL 传递变量来测试 login.php。我知道这可行,如果有效则返回 1,如果无效则返回 0。

我已经测试了 login.js,因为当我点击登录时它会弹出“Hello”。

发生的事情是,一旦 login.php 将结果发回,我就什么也找不到了。例如,警告框“再见”没有出现。

我无法确定 login.php 是否正确返回或 login.js 是否正确处理结果。

4

1 回答 1

2

登录测试.html:

<form action="login.php" method=POST>
  Username<input type="text" name="username" /><br />
  Password<input type="password" name="password"<br />
  <input type="submit">
</form>
  1. 使用简单的测试表格来测试您的 PHP,将 javascript 排除在外。
  2. 不要将密码转换为大写,您的有效安全性会降低大约一半。
  3. 不要以纯文本形式存储您的密码!
  4. 不要将未经验证的用户输入连接到 SQL 查询中。
    • 考虑用户名:BobbyTables' OR 1=1;--
  5. 不要将用户名和密码记录到文件中!
  6. 我不理解GROUP BY您查询中的条款,您没有使用任何聚合函数。
于 2013-09-09T17:07:31.217 回答