管理頁面會話中的可變錯誤

Question

我正在爲網站創建登錄。我可以得到下面的代碼工作：它讓我登錄！然而，我無法開始工作：人們仍然可以通過URL訪問我的頁面。

登錄PHP：

<?php 
    //calling connection to database 
    include "connection.php"; 
    //if user posts for called login 
    if(isset($_POST['login'])){ 
     //declaring variables for user input and using escape string to protect php scripts 
     $user = mysqli_real_escape_string($dbconn,$_POST['user']); 
     $pass = mysqli_real_escape_string($dbconn,$_POST['pass']); 
     //select from users table where user input matches un and pw 
     $sel_user = "SELECT * from users where un='$user' AND pw='$pass'"; 
     //put content held in sel_user into variable run_user 
     $run_user = mysqli_query($dbconn, $sel_user); 
     //use run_user counting rows and save in check_user 
     $check_user = mysqli_num_rows($run_user); 
     //if content row numbers greater than 0 
     if($check_user>0){ 
      //session where un is equal to user input stored in $user 
      $_SESSION['username']=$user; 
      //display admin main page 
      header('Location: ../adminmain.php'); 
     } 
     else { 
      //display log in error page 
      header('Location: ../loginerror.php'); 
     } 
    } 
    //close database connection 
    mysqli_close($dbconn); 
?> 

啓動會話代碼，表示不確定的變量：

<?php 
    include"includes/loginrequiredb.php"; 
    if($_SESSION['username'] !=$user){ 
     session_destroy(); 
     header("Location: view.php"); 
     die(); 
    }else 
    { 
     echo "welcome to the site you have logged in" . $_SESSION['username']; 
    } 
?> 

Answer 1

，而無需啓動會話，你不能從$_SESSION得到的值。

你只需要在這兩個文件來啓動會話：

session_start(); 

請注意，您需要start_session()僅在短短的歡迎文件這兩個文件。

旁註：

我建議也使用isset()檢查或者值設置與否。

Answer 2

用session_start啓動會話並在adminmain.php頁面添加會話驗證文件。

<?php 

//calling connection to database 
include "connection.php"; 
@session_start(); 
//session 
//if user posts for called login 
if(isset($_POST['login'])){ 
    //declaring variables for user input and using escape string to protect php scripts 
    $user = mysqli_real_escape_string($dbconn,$_POST['user']); 
    $pass = mysqli_real_escape_string($dbconn,$_POST['pass']); 
    //select from users table where user input matches un and pw 
    $sel_user = "SELECT * from users where un='$user' AND pw='$pass'"; 
    //put content held in sel_user into variable run_user 
    $run_user = mysqli_query($dbconn, $sel_user); 
    //use run_user counting rows and save in check_user 
    $check_user = mysqli_num_rows($run_user); 
    //if content row numbers greater than 0 
    if($check_user>0){ 
     //session where un is equal to user input stored in $user 
     $_SESSION['username']=$user; 
     //display admin main page 
     header('Location: ../adminmain.php'); 
    } 
    else { 
     //display log in error page 
     header('Location: ../loginerror.php'); 
    } 
} 
//close database connection 
mysqli_close($dbconn); 
?> 




##### file verify.php ##### 
<?php @session_start(); 

    if (@$_SESSION['username']!=$user) { 
    header ("location: index.php"); 
    exit; 
    } 
?>