提交後登錄

Question

我有以下的HTML文件，用戶將輸入他們的用戶名和密碼，然後單擊提交按鈕。

<form Name ="form1" Method ="POST" ACTION = "userlogin.php" id="form1"> 
    <div id="main_body" class="full-width"> 
     <label>Username:</label> 
     <input type = "text" 
       id = "usernameLogin" 
       name="pat_username"> 
     <label>Password:</label> 
     <input type = "password" 
       id = "passwordLogin" 
       name="pat_password"> 
     <input type="submit" onclick="click_button_login()" value="Login" name="submit" id="submit"/> 
    </div> 
</form> 

PHP文件應該連接到我的數據庫並檢查輸入的用戶詳細信息是否正確。數據庫連接在那裏，因爲我以前測試過。一旦用戶點擊提交按鈕會出現這樣的錯誤：Cannot POST /http-services/emulator-webserver/ripple/userapp/x/C/xampp/htdocs/xampp/glove_project_php/www/userlogin.php

<?php 
if(isset($_POST["submit"])){ 
    $servername = "localhost"; 
    $username = "root"; 
    $password = ""; 
    $dbname = "dbname"; 

    // Create connection 
    $conn = new mysqli($servername, $username, $password, $dbname); 

    //Check connection 
    if ($conn->connect_error) { 
     die("Connection failed: " . $conn->connect_error); 
    } 


    $newUsername = mysqli_real_escape_string($conn, $_POST['pat_username']); 
    $newPassword = mysqli_real_escape_string($conn, $_POST['pat_password']); 

    $result = $conn->query("SELECT * FROM tablename WHERE patient_username ='$newUsername' AND patient_password='$newPassword'"); 



    if (mysqli_num_rows($result)) { 
     header("Location: mainmenu.html");  
    } 
    else 
    {  
     header("Location: index.html"); 

    } 
    $conn->close(); 
} 
?> 

有沒有調用這個PHP文件到模擬器上進行工作以不同的方式？這段代碼在localhost上完美工作。

Answer 1

你爲什麼要檢查$ _POST超全局中是否存在$ _POST [「submit」]？我相信，如果你發送的變量的設置，你應該檢查：

變化：

if(isset($_POST["submit"])) 

到：

if ((isset($_POST["pat_username"]))&&(isset($_POST["pat_password"]))) 

，讓我知道如果錯誤仍然存​​在。

Answer 2

Your form, you should working on security and eliminating auto submission, this eliminates auto submission as form contains SESSION_ID() which are unique on web browsing session. 

    <Form Name ="form1" Method ="POST" ACTION = "userlogin.php" id="form1"> 
    <div id="main_body" class="full-width"> 
     <br> 
     <br>      
        <label>Username:</label> 
        <input type = "text" 
          id = "usernameLogin" 
          name="pat_username"> <br> 

       <br> <label>Password:</label> 
        <input type = "password" 
          id = "passwordLogin" 
          name="pat_password"> <br><button value="<?php echo session_id() ?>" type="submit" name="login_check">Login</button> 

    </div> 
    </Form> 

//您的登錄檢查頁面存在太多安全隱患。密碼應該被加密。請使用SALT,hash/md5/sha for 加密。同時還爲查詢中使用的sprintf因爲這樣它只是一個雖然

##SPRINTF EXAMPLE CODE 
    //$query = sprintf('SELECT * FROM TABLE WHERE username = "%s" AND password = "%s"',mysql_real_escape_string($username),mysql_real_escape_string($password)); 

    #### EXAMPLE END HERE## 

    <?php 
    if(isset($_POST["login_check"]) && $_POST['login_check']==session_id()){ 
    $servername = "localhost"; 
    $username = "root"; 
    $password = ""; 
    $dbname = "dbname"; 

    // Create connection 
    $conn = new mysqli($servername, $username, $password, $dbname); 

    //Check connection 
    if ($conn->connect_error) { 
    die("Connection failed: " . $conn->connect_error); 
    } 


$newUsername = mysqli_real_escape_string($conn, $_POST['pat_username']); 
$newPassword = mysqli_real_escape_string($conn, $_POST['pat_password']); 

$result = $conn->query("SELECT * FROM tablename WHERE patient_username ='$newUsername' AND patient_password='$newPassword'"); 



if (mysqli_num_rows($result)) { 
    header("Location: mainmenu.html");  
} 
else 
{  
    header("Location: index.html"); 

} 
$conn->close(); 
} 
?>