2014-09-03 32 views
0

我已經能夠擁有受密碼保護的頁面或顯示用戶信息的頁面,但無法使它們一起工作。我知道我失去了一些東西簡單,但我已經在太長時間尋找:密碼保護爲下一頁設置用戶並仍然檢查密碼的PHP頁面

<?php 

$db_host = "localhost"; 
$db_username = "1"; 
$db_pass = "1"; 
$db_name = "1"; 
mysql_connect("$db_host","$db_username","$db_pass") or die(mysql_error()); 
mysql_select_db("$db_name") or die ("no database"); 

$email = mysql_query ("SELECT email FROM maindata2"); 
while($row=mysql_fetch_array($email)) { $allemail = $row['email']; 
} 

$LOGIN_INFORMATION = array(
    'email' => 'pass', 






); 


// request login? true - show login and password boxes, false - password box only 
define('USE_USERNAME', true); 

// User will be redirected to this page after logout 
define('LOGOUT_URL', 'http://www.wwwww.com/'); 

// time out after NN minutes of inactivity. Set to 0 to not timeout 
define('TIMEOUT_MINUTES', 60); 

// This parameter is only useful when TIMEOUT_MINUTES is not zero 
// true - timeout time from last activity, false - timeout time from login 
define('TIMEOUT_CHECK_ACTIVITY', true); 


// show usage example 
if(isset($_GET['help'])) { 
    die('Include following code into every page you would like to protect, at the very beginning (first line):<br>&lt;?php include("' . str_replace('\\','\\\\',__FILE__) . '"); ?&gt;'); 
} 

// timeout in seconds 
$timeout = (TIMEOUT_MINUTES == 0 ? 0 : time() + TIMEOUT_MINUTES * 60); 

// logout? 
if(isset($_GET['logout'])) { 
    setcookie("verify", '', $timeout, '/'); // clear password; 
    header('Location: ' . LOGOUT_URL); 
    exit(); 
} 

if(!function_exists('showLoginPasswordProtect')) { 

// show login form 
function showLoginPasswordProtect($error_msg) { 
?> 
<html> 
<head> 
    <title>Please enter password to access this page</title> 
    <META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE"> 
    <META HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE"> 
<?php include_once "meta1.php"; ?> 
</head> 
<body> 
<?php include_once "header.php"; ?> 

<div id="main-content"> 
    <style> 
    input { border: 1px solid black; } 
    </style> 
    <div style="width:500px; margin-left:auto; margin-right:auto; text-align:center"> 

<div id="form1"> 
    <form name="form2" method="POST" action="display.php"> 
    <h3>Please enter password to access this page</h3> 
    <font color="red"><?php echo $error_msg; ?></font><br /> 
<?php if (USE_USERNAME) echo 'Email Address:<br /><input type="input" name="access_login" /><br />Password:<br />'; ?> 
    <input type="password" name="access_password" /><p></p><br /><input type="submit" name="Submit" value="Submit" /> 
    </form> 
    <br /> 
<br /> 
<a style="font-size:12px; color: #000; font-family: Verdana, Arial;" href="http://wwwwww.com/contact" title="Contact us">Forgot Your Password?</a> 
    </div> 

<br> 
<center><b>Existing Customers, please contact to request a login user name and password</b> 
<br> 
<br> 
<a href="#" onClick="window.open('http://www.wwww.com/images/sampledata.png', 'WindowC', 'width=850, height=600,scrollbars=yes');">View Sample Data</a></center> 


</div> 
<br> 
<br> 
</div> 
</body> 
</html> 

<?php 
    // stop at this point 
    die(); 
} 
} 

// user provided password 
if (isset($_POST['access_password'])) { 

    $login = isset($_POST['access_login']) ? $_POST['access_login'] : ''; 
$pass = $_POST['access_password']; 
$login = strtolower($login); 
    if (!USE_USERNAME && !in_array($pass, $LOGIN_INFORMATION) 
    || (USE_USERNAME && (!array_key_exists($login, $LOGIN_INFORMATION) || $LOGIN_INFORMATION[$login] != $pass)) 
) { 
    showLoginPasswordProtect("Incorrect password."); 
    } 
    else { 
    // set cookie if password was validated 
    setcookie("verify", md5($login.'%'.$pass), $timeout, '/'); 

    // Some programs (like Form1 Bilder) check $_POST array to see if parameters passed 
    // So need to clear password protector variables 

    } 

} 

else { 

    // check if password cookie is set 
    if (!isset($_COOKIE['verify'])) { 
    showLoginPasswordProtect(""); 
    } 

    // check if cookie is good 
    $found = false; 
    foreach($LOGIN_INFORMATION as $key=>$val) { 
    $lp = (USE_USERNAME ? $key : '') .'%'.$val; 
    if ($_COOKIE['verify'] == md5($lp)) { 
     $found = true; 
     // prolong timeout 
     if (TIMEOUT_CHECK_ACTIVITY) { 
     setcookie("verify", md5($lp), $timeout, '/'); 
     } 
     break; 
    } 
    } 
    if (!$found) { 
    showLoginPasswordProtect(""); 
    } 

} 

?> 

現在,用戶可以輸入自己的電子郵件,直接進入顯示頁面,並將它傳遞的信息和完美的顯示一切唯一的問題是,先不檢查密碼,我知道這是我設置的順序,但無法弄清楚如何使其工作。

回答

0

這是處理密碼訪問的一種奇怪的方式。首先你不應該發送密碼數據給用戶,即使有些加密。我建議你使用會話。在驗證部分開始之前致電session_start();。在密碼驗證部分,您可以在登錄名爲$_SESSION['login'] = $login;時將用戶名寫入您的會話中,這使登錄用戶的驗證更加容易,例如if (array_key_exists('login', $_SESSION)) { echo "Im am a logged in user!"; } else { echo "Please log in now!"; }。正如你所看到的,更少的代碼和方式更安全。另外,你的SQL目前什麼都不做,因爲所有的電子郵件地址都會互相覆蓋,甚至不會使用結果。你也應該關閉你的連接,而不僅僅是die();