php–我无法使用我的登录表单连接与mySQL数据库正常交互

我想要发生的是用户使用用户名和密码登录,如果该数据与数据库中的数据匹配.当我尝试时,我没有得到任何错误,但它不起作用.我在Dreamweaver中使用html和php,在phpMyAdmin中使用WAM.我将包括表单文档和随附的php文档：

loginpage.php

include('login.php'); // Includes Login Script
if(isset($_SESSION['login_user'])){
header("location: index.php");
}
?>


&＃160;

的login.php






session_start(); // Starting Session
$error=''; // Variable To Store Error Message
if (isset($_POST['submit'])) {
if (empty($_POST['username']) || empty($_POST['password'])) {
$error = "Username or Password is invalid";
}
else
{
// Define $username and $password
$username=$_POST['username'];
$password=$_POST['password'];
// Establishing Connection with Server by passing server_name, user_id and password as a parameter
$hostname= "localhost";
$database = "boost";
$username = "root";
$password = "";
$localhost = mysqli_connect($hostname, $username, $password, $database);
if(mysqli_connect_errno())
{
die("Connection Failed".mysqli_error());
}
// SQL query to fetch information of registerd users and finds user match.
$sql = "SELECT * FROM `users`";
$query = mysqli_query($localhost,$sql);
if(!$query)
{
die("Query Failed".mysqli_error($localhost));
}
$rows = mysqli_num_rows($query);
if ($rows == 1) {
$_SESSION['login_user']=$username; // Initializing Session
echo "You are now logged on!";
} else {
$error = "Username or Password is invalid";
}
mysqli_close($localhost); // Closing Connection
}
}
?>




解决方法:

这个答案适用于散列,password_hash()和password_verify().对于mysqli和pdo.底部的链接还有一些关于盐等的链接和一些语言.

至关重要的是不要直接使用用户提供的数据进行选择和插入.相反,将参数绑定并将预准备语句调用到Avoid sql injection attacks.密码永远不应保存在数据库中的明文(明文)中.相反,它们应该通过单向哈希发送.

另请注意.这显示了注册哈希和登录验证.它不是完全成熟的功能我试图在codecanyon上购买十块钱…这样它显示重新注册的电子邮件地址(登录)已经存在,更新,请注意.在这种情况下,由于db中的唯一键设置,插入将简单地失败.我把这个留给你,读者,进行查询,然后说’电子邮件已经注册’.

架构

CREATE TABLE `user_accounts2` (
`id` int(11) NOT NULL AUTO_INCREMENT,
`email` varchar(100) NOT NULL,
`password` varchar(255) NOT NULL,
PRIMARY KEY (`id`),
unique key(email) -- that better be the case
) ENGINE=InnoDB;


运行register.php并保存用户后,数据可能如下所示：

select * from user_accounts2;
+----+-----------+--------------------------------------------------------------+
| id | email | password |
+----+-----------+--------------------------------------------------------------+
| 1 | d@d.com | $2y$10$U6.WR.tiOIYNGDWddfT7kevJU8uiz8KAkdxXpda9e1xuplhC/eTJS |
+----+-----------+--------------------------------------------------------------+


mysqli section first

register.php

mysqli_report(MYSQLI_REPORT_ALL);
error_reporting(E_ALL); // report all PHP errors
ini_set("display_errors", 1); // display them
session_start();
if(isset($_SESSION['userid'])!="") {
// you are already logged in as session has been set
header("Location: safe.php"); // note that this re-direct will at the top of that page
// ... and there to verify the session state so no tricks can be performed
// no tricks and gimmicks
}
if(isset($_POST['register'])) {
$email = $_POST['email'];
$ctPassword = $_POST['password']; // cleartext password from user
$hp=password_hash($ctPassword,PASSWORD_DEFAULT); // hashed password using cleartext one
// pretend the following is locked in a vault and loaded but hard coded here
$host="yourhostname";
$dbname="dbname";
$user="dbuser";
$pwd="password";
$port=3306; // comes along for the ride so I don't need to look up param order below
// end pretend
try {
$mysqli= new mysqli($host, $user, $pwd, $dbname,$port);
if ($mysqli->connect_error) {die('Connect Error (' . $mysqli->connect_errno . ') ' . $mysqli->connect_error);
}
//echo "I am connected and feel happy.
";
$query = "INSERT INTO user_accounts2(email,password) VALUES (?,?)";
$stmt = $mysqli->prepare($query);
// note the 2 s's below, s is for string
$stmt->bind_param("ss", $email,$hp); // never ever use non-sanitized user supplied data. Bind it
$stmt->execute();
// password is saved as hashed, will be verified on login page with password_verify()
$iLastInsertId=$mysqli->insert_id; // do something special with this (or not)
// redirect to some login page (for now you just sit here)
$stmt->close();
$mysqli->close();
} catch (mysqli_sql_exception $e) {
throw $e;
}
}
?>