0

此登录脚本似乎不起作用。我检查了它是否通过了 if 语句，它确实通过了。还有什么问题？

处理登录的脚本：

<?php
    include("config.php");

    $myusername=$_POST['myusername']; 
    $mypassword=$_POST['mypassword']; 

    $myusername = stripslashes($myusername);
    $mypassword = stripslashes($mypassword);
    $myusername = mysql_real_escape_string($myusername);
    $mypassword = mysql_real_escape_string($mypassword);
    $sql="SELECT * FROM " .$members. " WHERE BINARY `username`= '".$myusername."' and BINARY `password`= '".$mypassword."'";
    $result=mysql_query($sql);

    $count=mysql_num_rows($result);

    $row = mysql_fetch_array( $result );

    if($count==1){
        $_SESSION['username'] = $myusername;
        $_SESSION['password'] = $mypassword;
        $_SESSION['privileges'] = $row['privileges'];
        $_SESSION['email'] = $row['email'];
        header("location:index.php");
    }
?>

检查用户是否登录的脚本index.php：

<?
    session_start();
    if(!isset($_SESSION['username'])){
        header("location:login.php");
    }       
?>
4

2 回答 2

0

首先，session_start();必须在页面的最顶部。另外，我看不到$members任何地方的定义。尝试这个。

<?php
session_start();
include("config.php");

$myusername = $_POST['myusername']; 
$mypassword = $_POST['mypassword']; 

$username = stripslashes($myusername);
$password = stripslashes($mypassword);
$esc_username = mysql_real_escape_string($username);
$esc_password = mysql_real_escape_string($password);

$sql = "SELECT * FROM table_name WHERE BINARY `username`= '".$esc_username."' and BINARY `password`= '".$esc_password."'";
$result = mysql_query($sql);
$count = mysql_num_rows($result);

if($count == 1) {
    while($row = mysql_fetch_assoc($result)) {
        $_SESSION['username'] = $myusername;
        $_SESSION['password'] = $mypassword;
        $_SESSION['privileges'] = $row['privileges'];
        $_SESSION['email'] = $row['email'];
    }

    header("location:index.php");
}
?>
于 2013-10-08T14:32:37.427 回答
0

像这样改进你的代码

登录-exec.php

    <?php
//Start Session
session_start();
//Function to sanitize values received from the form. Prevents SQL injection
function clean($str) {
    $str = @trim($str);
    if(get_magic_quotes_gpc()) {
        $str = stripslashes($str);
    }
    return mysql_real_escape_string($str);
}

//Sanitize the POST values
$myusername = clean($_POST['myusername']);
$mypassword = clean($_POST['mypassword']);


//Create query
$qry="SELECT * FROM " .$members. " WHERE `username`='".$myusername."' AND `password`='".$mypassword."'";
$result=mysql_query($qry);

//Check whether the query was successful or not
if($result) {
    if(mysql_num_rows($result) == 1) {
        //Login Successful
        session_regenerate_id();
        $member = mysql_fetch_assoc($result);
        $_SESSION['SESS_MEMBER_ID'] = $member['member_id'];
        $_SESSION['SESS_FIRST_NAME'] = $member['firstname'];
        $_SESSION['SESS_LAST_NAME'] = $member['lastname'];
        $_SESSION['SESS_EMAIL'] = $member['email'];
        $_SESSION['SESS_USER_NAME'] = $member['username'];
        session_write_close();
        header("location: index.php");
        exit();
    }else {
        //Login failed
        header("location: login-failed.php");
        exit();
    }
}else {
    die("Query failed");
}

?>

并将您的 index.php 保留在其中

  <?php session_start(); ?>
  <?php 
require_once('safe.php');
 ?>

创建一个php页面输入此代码以检查用户

<?php
//Start session
session_start();

//Check whether the session variable SESS_MEMBER_ID is present or not
if(!isset($_SESSION['SESS_MEMBER_ID']) || (trim($_SESSION['SESS_MEMBER_ID']) == '')) {
    header("location: access-denied.php");
    exit();
}

?>

于 2013-10-08T14:30:04.670 回答