登錄頁面無法繼續請求？

Question

我有使用MVC模式的登錄系統，雖然它仍然是程序性的，並且已經過了4個小時，並且不能工作。它繼續執行最後一個'else'語句，該語句被重定向回login.php。這是我的代碼

登錄頁面：

<?php include 'view/template/header.php' ?> 

<div class="container"> 
    <div class="row"> 
     <div class="col-lg-6 col-lg-offset-3"> 
      <div class="login-style"> 
      <h2>Silahkan Login</h2> 
       <form action="controller/controller-login-admin.php" method="POST"> 
       <div class="form-group"> 
        <label for="username">Username:</label> 
        <input type="text" name="username" class="form-control" id="username"> 
       </div> 
       <div class="form-group"> 
        <label for="pwd">Password:</label> 
        <input type="password" name="password" class="form-control" id="pwd"> 
       </div> 
        <button type="submit" name="submit-admin-login" class="btn btn-primary">Submit</button> 
       </form> 
      </div> 
     </div> 
    </div> 
</div> 

<?php include 'view/template/footer.php' ?> 

控制器

<?php 
require_once $_SERVER['DOCUMENT_ROOT']. '/project-school-frontend/admin/model/admin-model-master.php'; 

if (isset($_POST['submit-admin-login'])){ 
    $username=mysqli_real_escape_string($koneksi, $_POST['username']); 
    $password=mysqli_real_escape_string($koneksi, md5($_POST['password'])); 
    loginUser($username, $password); 
} 

（控制器正常工作）

型號：

<?php 

require_once $_SERVER['DOCUMENT_ROOT']. '/project-school-frontend/config/database.php'; 

function loginUser($username, $password){ 

    global $koneksi; 
    if (empty($username) && !empty($password)) 
     { 
      $_SESSION['pesan'] = 'Userid harus diisi'; 
      $_SESSION['alert'] = 'info'; 
      header('location:../login.php'); 
     } 
     elseif (empty($password) && !empty($username)) 
     { 
      $_SESSION['pesan'] = 'Password harus diisi'; 
      $_SESSION['alert'] = 'info'; 
      header('location:../login.php'); 
     } 
     elseif (empty($username && $password)) 
     { 
      $_SESSION['pesan'] = 'Userid dan password wajib diisi'; 
      $_SESSION['alert'] = 'info'; 
      header('location:../login.php'); 
     } 
     else 
     { 
      $sql= "SELECT * FROM admin WHERE username='$username' AND password='$password'"; 
      $query= mysqli_query($koneksi, $sql); 
      $result= mysqli_num_rows($query); 
      $row = mysqli_fetch_array($query); 

      if($result > 0) 
      { 
       session_start(); 
       $_SESSION['username']=$row['username']; 
       $_SESSION['level'] = $row['level']; 
       header('Location: ../view/admin-dashboard.php'); 
      } 
      else 
      { 
       header('Location: ../login.php'); 
      } 
     } 
} 

（這是怎麼開始的。該型號）

我該怎麼辦？

Answer 1

您可以看到幾個問題。

1. 這個功能做得太多了，需要一些重新安排
2. 你比較
3. 您必須對SQL語句的參數綁定有一個錯誤，這是不安全的，可能會搞亂了查詢，這取決於正在投入這些領域
4. 不要把session_start()在if條件
5. 您應該使用password_hash()和password_verify()（或等效庫）的密碼存儲和比較

/config.php

有一個包含基本的東西，總是包括每一個頂層頁面的第一件事就是在頁面配置文件來加載

<?php 
# Error reporting ON for development 
error_reporting(E_ALL); 
ini_set('display_errors',1); 
# Define separators for full compatibility 
define('DS',DIRECTORY_SEPARATOR); 
define('ROOT_DIR',__DIR__); 
define('FUNCTIONS',ROOT_DIR.DS.'functions'); 
# Start the session by default 
session_start(); 
# Add the database 
require_once(ROOT_DIR.DS.'project-school-frontend'.DS.'config'.DS.'database.php'); 

/功能/setError.php

創建一個函數來完成這部分，這樣你可以重用它。

<?php 
function setError($pesan,$alert,$redirect = false) 
    { 
     $_SESSION['pesan'] = $pesan; 
     $_SESSION['alert'] = $alert; 
     # Redirect if set 
     if($redirect) { 
      header("Location: {$redirect}"); 
      exit; 
     } 
    } 

/functions/loginUser.php

我不會用一個全局您的連接，而不是飼料中的函數使用參數的連接。

<?php 
function loginUser($koneksi, $username, $password){ 
    # Add messaging error 
    include_once(FUNCTIONS.DS.'setError.php'); 
    # Trim out values 
    $username = (!empty($username))? trim($username) : false; 
    $password = (!empty($password))? trim($password) : false; 
    # First check if either value is empty 
    if(empty($username) || empty($password)) { 
     # If both empty, set message 
     if(empty($username) && empty($password)) 
      $msg = 'Userid dan password wajib diisi'; 
     # If username empty, set message 
     elseif(empty($username)) 
      $msg = 'Userid harus diisi'; 
     # If password empty, set message 
     elseif(empty($password)) 
      $msg = 'Password harus diisi'; 
     # If something is really wrong, make unknown 
     else 
      $msg = 'Unknown error'; 
     # Set session values, redirec 
     setError($msg,'info','../login.php'); 
    } 
    else { 
     # Fetching the user from DB should be a function like getAdmin($koneksi,$username,$password) 
     # !***** BIND PARAMETERS HERE, THIS IS UNSAFE!!! ******! 
     $sql= "SELECT * FROM admin WHERE username='$username' AND password='$password'"; 
     $query= mysqli_query($koneksi, $sql); 
     $result= mysqli_num_rows($query); 
     $row = mysqli_fetch_array($query); 

     if($result > 0){ 
      $_SESSION['username'] = $row['username']; 
      $_SESSION['level'] = $row['level']; 
      header('Location: ../view/admin-dashboard.php'); 
      exit; 
     } 
     else{ 
      setError('Invalid Username or Password','info','../login.php'); 
     } 
    } 
}