PHP登錄表單不會登錄具有正確憑據的用戶

Question

我有一個php表單，當用戶提交的憑據不正確時，會獲取相應的錯誤消息，但是當使用正確的憑證時，登錄成功消息不會獲得相同的錯誤憑證消息。我已經嘗試使用哈希密碼和沒有運氣。這裏是我的登錄功能代碼：

function login($username, $password) { 

$host = 'localhost'; 
$user = 'jamaixan_bobsled'; 
$pass = 'v67fvg7gk_&g'; 
$db = 'db_for_site_67'; 
mysql_connect($host, $user, $pass); 
mysql_select_db($db); 
$connected = mysql_select_db($db); 

$user_id = user_id_from_username ($username); 
$password = md5($password); 

return(mysql_result(mysql_query("SELECT COUNT(`id_user`) FROM `table_of_users` WHERE 

`email_user` = `$username` AND `password_user` = `$password`") , 0) == 1) ? $user_id : `false`; 
    } 

Answer 1

我建議您使用PDO，一種更安全的方式來處理數據庫請求。 mysql_ *函數已被棄用。

http://www.php.net/manual/en/book.pdo.php

Answer 2

你不應該把用戶名和密碼值反引號，把它們放在引號中。您甚至將false置於反推。這樣做：

$result = mysql_query("SELECT COUNT(`id_user`) FROM `table_of_users` WHERE 
      `email_user` = '$username' AND `password_user` = '$password'"); 

return (mysql_num_rows($result)>0) ? $user_id : false; 

Answer 3

使用mysqli_ *或PDO ... MySQL是過時

function login($username, $password) 
{ 
    $cn = mysqli_connect('localhost', 'jamaixan_bobsled', 'v67fvg7gk_&g', 'db_for_site_67') or die('Connection error!'); 

    $SQL = "SELECT COUNT(id_user) FROM table_of_users WHERE email_user = '%s' AND password_user = '%s'"; 

    $Query = sprintf($SQL, mysqli_real_escape_string($username), md5($password)); 

    $Result = mysqli_query($cn, $Query) or die(mysqli_error($cn)); 

    $Rows = mysqli_fetch_array($Result); 

    return (isset($Rows[0]) && ($Rows[0] > 0)); 
} 

Answer 4

function connectdb() 
{ 
    $dbhost='localhost'; 
    $dbname='db_for_site_67'; 
    $dbuser="jamaixan_bobsled"; 
    $pwd="v67fvg7gk_&g"; 

    try 
    { 
     $db=mysql_connect($dbhost,$dbuser,$pwd); 
     if($db) 
     { 
      try 
      { 
       $dbselect=mysql_select_db($dbname,$db); 
       if(!$dbselect) 
       { 
        throw new Exception("Unable to select database: $dbname with error ". mysql_error()); 
       } 
      } 
      catch(Exception $e) 
      { 
       echo $e->getMessage(); 
      } 
     } 
     else 
     { 
      throw new Exception("Unable to connect to database with error ". mysql_error()); 
     } 
    } 
    catch(Exception $e) 
    { 
     echo $e->getMessage(); 
    } 
    return $db; 
} 


function login($username, $password) { 

$user_id = user_id_from_username ($username); 
$password = md5($password); 
$conn1=connectdb(); 
$sql1="SELECT COUNT(`id_user`) FROM `table_of_users` WHERE `email_user` = $username AND `password_user` = $password"; 
$res1=mysql_query($sql1); 
$res1=mysql_fetch_array($res1); 
$res1=$res1['COUNT(`id_user`)']; 
if($res1==1){ 
    echo "login sucessful"; 
} else { 
    echo "login Failed"; 
} 

    }