mysql_fetch assoc拒絕返回密碼行。需要幫助

Question

用戶名行完好顯示，但密碼行拒絕通過。

我在這裏不知所措。

有誰知道解決方案是什麼？

這裏是我的代碼::

<?php 

//Mass include file 
include ("includes/mass.php"); 

//This is the login script 
//Grabbing the login values and storing them 

$username = $_POST['username']; 
$password = $_POST['password']; 
$submit = $_POST['submit']; 

if (isset($submit)) 
{ 
    if (strlen($username)<2) // put || ($username==(same as value on the database) 
    { 
     echo ("<br>You must enter a longer username</br>"); 
    } 
    elseif (strlen($password)<=6) 
    { 
     echo ("<br>You must enter a longer password<br>"); 
    } 
    else 
    { 
     $sql = "SELECT * FROM user WHERE username = '$username'"; 
     $query = mysql_query($sql); 
     $numrows = mysql_num_rows($query); 

     if ($numrows != 0) 
     { 
      while ($row = mysql_fetch_assoc($query)) 
       $dbusername = $row['username']; 
      $dbpassword = $row['password'];   

      if ($dbusername == $username && $dbpassword == $password) 
      { 
       echo "your in!"; 
      } 
      else 
      { 
       echo "Wrong info"; 
      } 
     } 
     else 
     { 
      die ("That username doesnt exist"); 
     } 
    } 
} 

?> 

Answer 1

你有一段時間後，丟失的圓括號。

兩個

$dbusername = $row['username']; 
$dbpassword = $row['password'];  

應該是while循環這不是在殼體內。

你需要做的是這樣的：

while ($row = mysql_fetch_assoc($query)) { 

    $dbusername = $row['username']; 
    $dbpassword = $row['password'];   

    if ($dbusername == $username && $dbpassword == $password) { 
     echo "your in!"; 
    } 
.... 

添加到什麼馬修說：

你不應該像顯示信息「的用戶名犯規存在」給用戶。這爲希望入侵的黑客提供了有價值的信息。如果用戶提供了錯誤的用戶名和/或錯誤的密碼，則應顯示「無效的用戶名或密碼」。

Answer 2

如果用戶名不唯一，您的腳本將失敗。這可能是這種情況嗎？

除此之外，存儲密碼以純文本格式，而不是清理用戶輸入：非常糟糕的想法...

編輯：順便說一句，爲什麼難道你不檢查一個有效的用戶名/密碼組合在查詢本身：

... WHERE username='" . mysql_real_escape_string($username) . "' 
    AND password='" . some_hashing_function($password) . "'"; 

另一個編輯：你必須在所發生的事情仔細看;我的初始答案（非唯一用戶ID）可能是一個問題，但@ codaddict的答案已經可以解決您的問題。

基本上，就是你的發言，猶如沒有花括號是這樣的：

while ($row = mysql_fetch_assoc($query)) 
    $dbusername = $row['username']; 
    $dbpassword = $row['password'];   
    .... 

是PHP中的一樣：

while ($row = mysql_fetch_assoc($query)) 
{ 
    $dbusername = $row['username']; 
} 
$dbpassword = $row['password']; 
... 

所以，當你要填寫你的$時間dbpassword，$行已經是空的。

Answer 3

 
I like the suggestion about the {} that normally encompasses the code that occurs in a while loop. Id replace 

while ($row = mysql_fetch_assoc($query)) 
       $dbusername = $row['username']; 
      $dbpassword = $row['password']; 

with 

while ($row = mysql_fetch_assoc($query)) 
{ 
    $dbusername = $row['username']; 
    $dbpassword = $row['password']; 
} 
// this lets the loop finish so $dbusername and $dbpassword are potentially set 
// so you can contine with your if statements 

Another thing to check is your html - check your password field looks something 
like <input type="password" name="password" /> 

You could always try echo $password; immediately after $_POST['password'] to see 
if it existed in the first place. Then echo any of your variables after they have 
been set to see if they exist.