我創建了一個登錄系統,登錄後用戶將被重定向到profile.php
。在profile.php
頁面,標題會說Welcome [username]
無限重定向循環+ php不回顯變量
session.php文件:
$connection = mysqli_connect("localhost", "root", "");
$db = mysqli_select_db($connection, "id2290767_wp");
session_start();
$user_check = isset($_SESSION['login_user']);
$ses_sql = mysqli_query($connection, "select name from login where name='$user_check'");
$row = mysqli_fetch_assoc($ses_sql);
$login_session = $row['name'];
if(!empty($login_session)) {
mysqli_close($connection);
header('Location: members.php');
}
profile.php(一個與問候)
<?php
include('session.php');
if(!isset($_SESSION['login_user'])){
header("location: profile.php");
}
?>
<h1>Welcome <i><?php echo $login_session; ?></h1>
的signin.php的登錄鏈接form.php:
session_start(); // Starting Session
$error = ''; // Variable To Store Error Message
if(isset($_POST['submit'])) {
if(empty($_POST['username']) || empty($_POST['password'])) {
$error = "Username or Password is invalid";
} else {
// Define $username and $password
$username = $_POST['username'];
$password = $_POST['password'];
// Establishing Connection with Server by passing server_name, user_id and password as a parameter
$connection = mysqli_connect("localhost", "root", "");
// To protect MySQL injection for Security purpose
$username = stripslashes($username);
$password = stripslashes($password);
$username = mysqli_real_escape_string($connection, $username);
$password = mysqli_real_escape_string($connection, $password);
// Selecting Database
$db = mysqli_select_db($connection, "id2290767_wp");
// SQL query to fetch information of registerd users and finds user match.
$query = mysqli_query($connection, "select * from login where password='$password' AND name='$username'");
$rows = mysqli_num_rows($query);
if($rows == 1) {
$_SESSION['login_user'] = $username; // Initializing Session
header("location: profile.php"); // Redirecting To Other Page
} else {
$error = "Username or Password is invalid";
}
mysqli_close($connection); // Closing Connection
}
}
members.php:
<?php
include('signin.php'); // Includes Login Script
if(isset($_SESSION['login_user'])){
header("location: profile.php");
}
但是我在PHP頁面中沒有找到任何文本。它只是說「歡迎」。
我做錯了什麼?
編輯:獲得無限循環改變
$user_check = isset($_SESSION['login_user']);
後
$user_check=isset($_SESSION['login_user']) ? $_SESSION['login_user'] : "";
[小博](http://bobby-tables.com/)說** [你的腳本是在對SQL注入攻擊的風險( http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)**。瞭解[MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php)的[Prepared Statements](準備語句)(http://en.wikipedia.org/wiki/Prepared_statement)。即使** [轉義字符串](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string)**是不安全的! – GrumpyCrouton
你的歡迎頁面是'members.php'?我對嗎? –
不,歡迎頁面在profile.php,memebrs.php有登錄表單並且重定向到profile.php,如果會話 –