0

这是我的身份验证文件，我有一个数据库

用户名密码电子邮件positief（这里是“1”或“0”，如果您有管理员权限，则为“1”）

我希望我的代码能够识别“1”并让您访问页面，如果您有 1“”，如果您没有，则无法输入。

<html>
<body>

<?php
session_start();    // Create the session, Ready for our login data.

$username = $_POST['username']; // Gets the username from the login.php page.
$password = $_POST['password']; // Gets the plain text password.
$database = "cmict_test";

// Connect to your database
mysql_connect("","","") or die(mysql_error());
mysql_select_db("$database");

$query = "SELECT * FROM users WHERE password = '$password' LIMIT 1"; 

$username = mysql_real_escape_string($username); // just to be sure.

$result = mysql_query($query) or die(mysql_error());

while($row = mysql_fetch_array($result)){
    $resusername = $row['username']; // username from DB
    $respassword = $row['password']; // password from DB
    $resemail = $row['email']; // email from db
    $admin = $row['positief'];
}

// Are they a valid user?

if ($resusername == $username && $respassword == $password) {
    // Yes they are.
    // Lets put some data in our session vars and mark them as logged in.
    $_SESSION['loggedin'] = "1";
    $_SESSION['email'] = $resemail;
    $_SESSION['username'] = $resusername;

    header("location:navigra.php");
}else{
    // No, Lets mark them as invalid.
    $_SESSION['loggedin'] = "0";
    echo "Sorry, Invalid details.<br>";
    die ('klik <a href="testlogin.php">hier</a> om opnieuw te proberen.');
}

if ($admin == 1) {
$_SESSION['logadmin'] = "1";
} else {
$_SESSION['logadmin'] = "0"
echo "You are no admin";
die ('klik <a href = "index.html">hier</a>');
}


?>

</body>
</html>

这就是我放在页面顶部的内容，以检查您是否已登录以及您是否拥有管理员权限

<?php
session_start(); // Start the session
$loggedin = $_SESSION['loggedin']; // Are they loggedin?
$logadmin = $_SESSION['logadmin']; // Are they admin?

// They are not logged in, Kill the page and ask them to login.
if ($loggedin != "1") {
die('Sorry you are not logged in, please click <a href="adminlogin.php">Here</a> to    
login');}

if ($logadmin != "1") {
die ('You have no POWER here');}

?>

有人可以帮我弄这个吗？我会很感激的。

先感谢您！

问候，

DT编码

4

1 回答 1

0 
<html>
<body>

<?php
session_start();    // Create the session, Ready for our login data.

$username = addslashes($_POST['username']); // Gets the username from the login.php page.
$password = addslashes($_POST['password']); // Gets the plain text password.
$database = "cmict_test";

// Connect to your database
mysql_connect("","","") or die(mysql_error());
mysql_select_db("$database");

$query = "SELECT * FROM users WHERE username = '$username' and password = '$password' LIMIT 1"; 

$username = mysql_real_escape_string($username); // just to be sure.

$result = mysql_query($query) or die(mysql_error());

while($row = mysql_fetch_array($result)){
    $resusername = $row['username']; // username from DB
    $respassword = $row['password']; // password from DB
    $resemail = $row['email']; // email from db
    $admin = $row['positief'];
}

// Are they a valid user?

if ($resusername == $username && $respassword == $password) {
    // Yes they are.
    // Lets put some data in our session vars and mark them as logged in.
    $_SESSION['loggedin'] = "1";
    $_SESSION['email'] = $resemail;
    $_SESSION['username'] = $resusername;
    $_SESSION['logadmin'] = $admin;

    header("location:navigra.php");

}else{
    // No, Lets mark them as invalid.
    $_SESSION['loggedin'] = "0";
    echo "Sorry, Invalid details.<br>";
    die ('klik <a href="testlogin.php">hier</a> om opnieuw te proberen.');
}



?>

</body>
</html>

EDIT :

-added check on username in sql query (as suggested by Jason)

-added addslashes for basic protection against SQL injection.

于 2014-03-04T08:58:01.277 回答