我的网页无法识别注册表中填写的数据

debugcn 发表于 Dev

乔瓦尼·卡布雷拉

我目前正在做一个网页，现在我专注于登录和注册表。我还连接了一个 sql 数据库。当我使用注册表单注册新用户时，数据库更新成功。问题是当我尝试使用该用户登录时，页面无法识别它。此外，如果我尝试使用我使用 Netbeans 手动引入的用户登录，它会识别它。

$con = mysqli_connect("localhost", "root", "mypassword");
if(!$con) {
    exit('Connect Error (' . mysqli_connect_errno() .') ' . mysqli_connect_error());
}

mysqli_set_charset($con, 'utf-8');

mysqli_select_db($con, "my_database");

$user = mysqli_real_escape_string($con, htmlentities($_POST['new_mail']));
$password = mysqli_real_escape_string($con, htmlentities($_POST['new_passwd']));
$sql = "INSERT INTO usuarios (usuario, clave) VALUES ('". $user ."' , ' ".md5($password)."')";
mysqli_query($con, $sql);
if(mysqli_affected_rows($con) > 0) {
     ?>
    <script type='text/javascript'>
        alert('You have been registered succesfully. Now you can access our website');
    </script>
    <?php
    header("Location: login_page.html");

    echo "<br><br><a href='index.php'>Go back</a>";
} else {
    if(mysqli_errno($con) == 1062) {
        echo "The e-mail address introduced is already on the system.";
        echo "<br><a href='register.html'>Try again</a>";
    } else {
        echo "Error: " .$sql . "<br>" . mysqli_error($con);
    }
}

这是我填写注册表后使用的代码。下一个是我在登录表单后使用的。

    $con = mysqli_connect("localhost", "root", "mypassword");
if(!$con) {
    exit('Connect Error (' . mysqli_connect_errno() .') ' . mysqli_connect_error());
}


if(mysqli_connect_errno()) {
    printf("Connect failed: %s\n", mysqli_connect_errno());
    exit();
}

mysqli_set_charset($con, 'utf-8');

mysqli_select_db($con, "my_database");

$user = mysqli_real_escape_string($con, htmlentities($_POST['username']));
$password = mysqli_real_escape_string($con, htmlentities($_POST['password']));

$sql = "SELECT * FROM usuarios WHERE usuario='" . $user ."' AND clave='" . md5($password) . "'";
mysqli_query($con, $sql);
if(mysqli_affected_rows($con) > 0) {
    //echo "Welcome " . $_SESSION['username'] . "!";
    //echo "<br><br><a href='user_page.php'>Main Page</a>";
    //echo "<br><a href= 'close_session.php'>Close Session</a>";
    header("Location: main_page.html");
} else {
    exit ("The user or password introduced are not correct");
}
$row = mysqli_fetch_row($sql);
$_SESSION['user'] = $row;
$_SESSION['username'] = $row[0];
mysqli_free_result($sql);

?>

感谢您的帮助。

巨大的焦耳

您在注册页面上犯的错误很少。

您没有使用准备好的语句。
您正在使用md5()代替password_hash()和password_verify()来保护您的密码。
您正在对密码使用清理机制，您不应该这样做，因为这可能会更改原始密码。

有了上述内容，您应该使用准备好的语句并利用密码散列和验证，

因此您的注册页面。应该看：

<?php
$con = mysqli_connect("localhost", "root", "mypassword");
if (!$con) {
    exit('Connect Error (' . mysqli_connect_errno() . ') ' . mysqli_connect_error());
}

mysqli_set_charset($con, 'utf-8');

mysqli_select_db($con, "my_database");

$user     = $_POST['new_mail'];
$password = $_POST['new_passwd'];

$hash = password_hash($password, PASSWORD_DEFAULT);

//check if user is not registered already, I'm not sure if you have user_id, what I know you should have id which is auto increment, then select that id
$sql  = "SELECT user_id FROM usuarios WHERE usuario = ? ";
$stmt = mysqli_prepare($con, $sql);
mysqli_stmt_bind_param($stmt, 's', $user);
mysqli_stmt_execute($stmt);
$result   = mysqli_stmt_get_result($stmt);
$num_rows = mysqli_num_rows($result);

if ($num_rows > 0) {
    //user exists

    echo "The e-mail address introduced is already on the system.";
    echo "<br><a href='register.html'>Try again</a>";
} else {
    //user does not exist register the user
    $query  = "INSERT INTO usuarios (usuario, clave) VALUES (?,?)";
    $insert = mysqli_prepare($con, $query);
    mysqli_stmt_bind_param($insert, "ss", $user, $hash);

    if (mysqli_stmt_execute($insert)):
?>

        <script type='text/javascript'>
        alert('You have been registered succesfully. Now you can access our website');
    </script>
    <?php
        header("Location: login_page.html");

        echo "<br><br><a href='index.php'>Go back</a>";
    else:
        printf("Error: %s.\n", mysqli_stmt_error($insert));
    endif;
}
?>

然后登录

<?php
session_start();
$con = mysqli_connect("localhost", "root", "mypassword");
if (!$con) {
    exit('Connect Error (' . mysqli_connect_errno() . ') ' . mysqli_connect_error());
}


if (mysqli_connect_errno()) {
    printf("Connect failed: %s\n", mysqli_connect_errno());
    exit();
}

mysqli_set_charset($con, 'utf-8');

mysqli_select_db($con, "my_database");

$user     = $_POST['username'];
$password = $_POST['password'];


#ONLY SELECT THE SPECIFIC COLUMNS YOU NEED, DON'T USE#

$sql  = "SELECT clave,anotherColumn,anotherColumn  FROM usuarios WHERE usuario= ? ";
$stmt = mysqli_prepare($con, $sql);
mysqli_stmt_bind_param($stmt, 's', $login);
mysqli_stmt_execute($stmt);
$result   = mysqli_stmt_get_result($stmt);
$num_rows = mysqli_num_rows($result);

if ($num_rows > 0) {

    $row = $row = mysqli_fetch_assoc($result);

    if (password_verify($password, $row['clave'])) {

        //passwords set sections, redirec
    } else {

        //user password does not match the stored hash return message
    }


} else {

    //username does not exist, do something
}


?>

本文收集自互联网，转载请注明来源。

如有侵权，请联系[email protected] 删除。