在php文件中彈出提醒腳本

Question

我正在嘗試讓用戶登錄。如果密碼和用戶名錯誤，我想要一個彈出窗口來提醒用戶出現錯誤。當他們關閉警報時，它會返回到index.php，這將返回到登錄屏幕。

但是，當它是錯誤的密碼/用戶名，最終返回到index.php首先沒有任何彈出消息。我的瀏覽器設置不阻止任何彈出窗口。我可以知道我做錯了嗎？

<?php 
    if($login == true){ 
     //Do login process 
     //this portion works as long as correct username and password 
    } 
    else{ 
     echo '<script language="javascript">alert("Please enter valid username and password");</script>'; 
     header("location:index.php"); 
    } 
?> 


//login.php 

<?php 
    $username = "exampleuser"; 
    $password = "examplepass"; 
    $host = "localhost"; 

    $dbHandle = mysql_connect($host, $username, $password) or die("Could not connect to database"); 

    $selected = mysql_select_db("database_name", $dbHandle); 

    $myUserName = $_POST['user']; 
    $myPassword = $_POST['pass']; 

    if(ctype_alnum($myUserName) && ctype_alnum($myPassword)){ 
     $query1 = "SELECT * FROM users WHERE username='$myUserName'"; 

     $result1 = mysql_query($query1); 
     $count1 = mysql_num_rows($result1); 

     if($count1 == 1){ 
      $query2 = "SELECT password FROM users WHERE username='$myUserName'"; 
      $result2 = mysql_query($query2); 

      $row = mysql_fetch_array($result2, MYSQL_ASSOC); 
      $pass = $row['password']; 

      if(password_verify($myPassword, $pass)){ 
       $seconds = 120 + time(); 
       setcookie(loggedIn, date("F js - g:i a"), $seconds); 
       header("location:mysite.php"); 
      } 
      else{ 
       echo '<script language="javascript"> 
         alert("Please enter valid username and password"); 
         window.location.href = "http://index.php"; 
        </script>'; 
       die(); 
      } 
     } 
     else{ 
       echo '<script language="javascript"> 
         alert("Please enter valid username and password"); 
         window.location.href = "http://index.php"; 
        </script>'; 
       die(); 
     } 
    } 
    else{ 
     echo '<script language="javascript"> 
       alert("Please enter valid username and password"); 
       window.location.href = "http://index.php"; 
      </script>'; 
     die(); 
    } 
?> 

Answer 1

如果你發送頭文件到php它會直接在index.php頁面進入你的條件後。

如果你試試這個代碼：

<?php 
if($login == true){ 
    //Do login process 
    //this portion works as long as correct username and password 
} 
else{ 
    echo '<script language="javascript"> 
     alert("Please enter valid username and password"); 
     window.location.href = "http://index.php"; 
</script>'; 
die(); 
} 

，你會看到你的代碼是正確的。您需要跟蹤彈出式關閉時的事件，以通過ajax或http重定向重定向到index.php。

編輯1：

在這裏，你有PDO一個完整的頁面。這不是完成這項工作的最佳方式，但它可行。正如你將在評論中看到的，你必須避免xss攻擊，你應該改變數據庫結構，保存密碼散列和鹽以隱藏用戶的清除密碼。

這是代碼。

<?php 
//login.php 
//connection via PDO 
try{ 
    $pdo = new PDO ('mysql:host=localhost; dbname=database_name', 'exampleuser' , 'examplepass', array(PDO::MYSQL_ATTR_INIT_COMMAND => "SET NAMES utf8")); 
    //alert errors and warnings 
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); 
}catch(PDOException $e){ 
    exit('Database Error.'); 
} 

//prepared statements sanitize input binding parameters, for you but you can use some libraries to prevent sql injection 
$myUserName = trim(filter_var($_POST['user'], FILTER_SANITIZE_STRING));; 
$myPassword = trim(filter_var($_POST['pass'], FILTER_SANITIZE_STRING));; 

if(!empty($myUserName) && ctype_alnum($myUserName) && !empty($myPassword) && ctype_alnum($myPassword)){ 
    $query1 = $pdo->prepare("SELECT password FROM users WHERE username = :username_param"); 
    //bind parameter avoiding principal injection (pdo does not cover xss attacks, avoid it with other methods) 
    $query1->bindParam("username_param", $myUserName); 
    $result = $query1->fetch(); 
    // or you can do $result = $query1->fetchColumn(); to get directly string instead of array 

    if($result['password']){ 
     //you should use password_verify() if you have an hash stored in database, you should not save password in database. 
     //please google about best practice storing password, it's full of beautiful guides 

     //bad practice but will do the work 
     if($myPassword == $result){ 
      $seconds = 120 + time(); 
      setcookie('loggedIn', date("F js - g:i a"), $seconds); 
      header("location:mysite.php"); 
     }else{ 
      printAlert("Password incorrect"); 
     } 
    }else{ 
     printAlert("Username not valid"); 
    } 
} 
else{ 
    printAlert("Invalid data"); 

} 

function printAlert($text){ 
    echo "<script language='javascript'> 
       alert('$text'); 
       window.location.href = 'http://index.php'; 
      </script>"; 
    die(); 
} 
?>