php登录页面-当我插入有效数据时，它不工作，但当我插入无效数据时，它工作正常[重复]

Question

我有个问题。我正在建立自己的登录页面，我有一些麻烦。当我测试我的页面，我插入无效的用户名和密码代码作品伟大。但是当我插入数据库中存在的数据时，它只是跳过了if（isset（$_POST[but_submit]））部分。这里会出什么问题？这是我的代码：

PHP:

  <?php include ("config.php");

 if(isset($_POST['but_submit'])){

     $uname = mysqli_real_escape_string($con,$_POST['txt_uname']);
     $password = mysqli_real_escape_string($con,$_POST['txt_pwd']);

     if ($uname != "" && $password != ""){

         $sql_query = "select count(*) as cntUser from users where Username='".$uname."' and passwrd='".$password."'";
         $result = mysqli_query($con,$sql_query);
         $row = mysqli_fetch_array($result);

         $count = $row['cntUser'];

         if($count > 0){

             $_SESSION['uname'] = $uname;

             header('Location: welcome.php');
         }else{
             echo "Invalid username and password";
         }

     } }

 ?>

超文本标记语言

<div class="container">
            <form method="post" action="">
            <div id="div_login">
                <h1>Login</h1>
                    <div>
                        <input type="text" class="textbox" id="txt_uname" name="txt_uname" placeholder="Username" />
                    </div>
                    <div>
                        <input type="password" class="textbox" id="txt_uname" name="txt_pwd" placeholder="Password"/>
                    </div>
                    <div>
                        <input type="submit" value="Submit" name="but_submit" id="but_submit" />
                    </div>
                </div>
            </form>
        </div>

我真的很高兴有人能帮我：）谢谢！

Answer 1

也许这会奏效？先调试是否缺少字段，然后执行SQL。

require_once 'config.php';

ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);

if (mysqli_connect_errno()) die(mysqli_connect_error());

# Debug what the issue is
foreach(array('but_submit', 'txt_uname', 'txt_pwd') as $arg)
    if(!isset($_POST[$arg]))
        die("{$arg} field is not set or empty");

# Prevent SQL injection
$stmt = $con->prepare("SELECT COUNT(*) as cntUser FROM users WHERE Username ? AND passwrd = ?");
$stmt->bind_param("ss", $_POST['txt_uname'], $_POST['txt_pwd']);
if(!$stmt->execute()){ mysqli_error($con); }
$stmt->store_result();

# Check the row count is more than 0
if($stmt->num_rows != 0) {
    session_start(); # Start session, if config.php already does this you can remove this
    $_SESSION['uname'] = $_POST['txt_uname']; # Think about injects here - use the database record not untrusted POST data
    header('Location: ' . sprintf("%s://%s/welcome.php", isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off' ? 'https' : 'http', $_SERVER['SERVER_NAME']));
    exit();
}

# Nothing was returned
die('Incorrect username / password combination');

需要注意的是，您不应该在会话中存储用户名，这应该是一个令牌，在您的案例中，用户名作为参数提供给该令牌：

$_SESSION['token'] = \Firebase\JWT\JWT::encode(array('username' => $_POST['uname']), 'your secret');

然后在您的Welcome.php文件中，您可以像这样解码它（建议构建某种控制器来完成此操作）：

$user = \Firebase\JWT\JWT::decode($_SESSION['token'], 'your secret', array('HS256'));
echo $user['username'];

另一件需要注意的事情是，最好将数据从数据库中取出，这样您就可以使用它们的唯一ID创建一个令牌以及您希望包含的其他标识（远离敏感信息）。