SQL代碼

Question

我想寫一個代碼來檢查用戶的用戶名和密碼登錄，但它只是說，成功登錄我每次運行它：

<?PHP 
$conn=mysql_connect('localhost','root'); 
if (!$conn) 
    die("couldn't connect" . mysql.error()); 
mysql_select_db('swimsafe'); 
if(isset($_POST['chkdbforpass'])); 
{ 
    $email=$_POST['chkdbforemail']; 
    $pass=$_POST['chkdbforpass']; 
    $sql='SELECT * FROM users WHERE Emailaddress="$email" AND password="$pass" '; 
    $result=mysql_query($sql,$conn); 
    if(!$result) 
     die("couldn't do the query" . mysql_error()); 
    echo("logged in successfully!"); 
    setcookie('username',$email); 
} 
mysql_close(); 
?> 

是否足夠還是我必須給你更多的信息？

Answer 1

mysql_*是安全的棄用。請使用PDO或MySQLi。

這是一個使用的mysqli檢查登錄的OOP方式（它負責SQL注入預防的同時）：

<?php 

// Connect 
$mysqli = new mysqli("localhost", "my_user", "my_password", "my_database"); 
if (mysqli_connect_errno()) { 
    printf("Connect failed: %s\n", mysqli_connect_error()); 
    exit(); 
} 

// Create a Prepared Statement 
if ($stmt = $mysqli->prepare("SELECT COUNT(*) AS userExists FROM users WHERE Emailaddress = ? AND password = ?")) 
{ 
    // Bind Params - SQL Injection Prevention 
    $stmt->bind_param("ss", 
     isset($_POST['chkdbforemail']) ? $_POST['chkdbforemail'] : '', 
     isset($_POST['chkdbforpass']) ? $_POST['chkdbforpass'] : ''); 

    // Execute Statement 
    $stmt->execute(); 

    // Get Result Row 
    $result = $stmt->get_result(); 
    $row = $result->fetch_assoc(); 

    // Check Login 
    if (isset($row['userExists']) && (int)$row['userExists'] >= 1) 
    { 
     // Login Success 
     echo "Login Correct - Set cookie"; 
    } 
    else 
    { 
     // Login Error 
     echo "Email Address and/or Password is incorrect."; 
    } 

    // Close Statement 
    $stmt->close(); 
} 

// Close Connection 
$mysqli->close(); 

?> 

Answer 2

我想猜你陳述是罪魁禍首後​​3210。

if(isset($_POST['chkdbforpass'])); 

應該是：

if(isset($_POST['chkdbforpass'])) // no ; 

PHP是因爲您正在使用過時的MySQL的功能反正試試這個訓釋它是這樣

if($ANYTHING_EVER); // the semicolon 
{ 
    // will always get here 
} 

Answer 3

，並告訴我，如果它工作或沒有。

<?PHP 
mysql_connect('localhost','root'); 

mysql_select_db('swimsafe'); 

if(isset($_POST['chkdbforpass'])) 
{ 
    $email=$_POST['chkdbforemail']; 
    $pass=$_POST['chkdbforpass']; 
    $sql='SELECT * FROM users WHERE Emailaddress="$email" AND password="$pass" ;'; 
    $result=mysql_query($sql) or die(mysql_error()); 
    if(!$result) 
     die("couldn't do the query" . mysql_error()); 
    echo("logged in successfully!"); 
    setcookie('username',$email); 
} 
mysql_close(); 
?> 

Answer 4

我建議你查找PDO的登錄系統，創建一個系統多一點從上面在下面的例子中，假設您已連接到數據庫

//check for empty username 
    if (!isset($_POST['login']) OR empty($_POST['login'])) { 
     $_SESSION["feedback_negative"][] = appFeedbackmsg_EmptyUsername; 
     return false; 
    } 
    //check for empty password 
    if (!isset($_POST['password']) OR empty($_POST['password'])) { 
     $_SESSION["feedback_negative"][] = appFeedbackmsg_EmptyPassword; 
     return false; 
    } 
$sth = $this->db->prepare("SELECT id, role FROM users WHERE 
      login = :login AND password = MD5(:password)"); 
    $sth->execute(array(
     ':login' => $_POST['login'], 
     ':password' => $_POST['password'] 
    )); 

    $data = $sth->fetch(); 

    $count = $sth->rowCount(); 
    if ($count > 0) { 
     // login 
     Session::init(); 
     Session::set('role', $data['role']); 
     Session::set('loggedIn', true); 
     header('location: ../dashboard'); 
    } else { 
     header('location: ../login'); 
    }