我的网站上有一个登录系统，有人可以在其中创建一个帐户，然后注销然后重新登录。当用户尝试登录一个不存在的帐户时，会显示一条消息。“电子邮件/用户名组合不正确”。我遇到的问题是，即使帐户确实存在，此消息也会显示。
这是 index.php
<!DOCTYPE html>
<?php
session_start();
if(isset($_SESSION['username'])) {
header("Location: home.php");
$_SESSION["success"] = "You are now logged in";
}
?>
<html>
<head>
</head>
<body>
<form action="verify_registration_form.php" method="post">
<br>
<input type="username" id="user_name" name="user_name" placeholder="Username" required>
<br><br><br><br><input type="password" id="user_pass_word" name="user_pass_word" placeholder="Password" required>
<br><br><br><br><input type="email" id="user_email" name="user_email" placeholder="Email" required>
<br><br><br><br><input type="submit" class="submit_registration_form_button" id="submit_registration_form_button" name="submit_registration_form_button" value="Sign Up">
</form>
<form action="verify_login_form.php" method="post">
<input type="username" id="user_email_login" name="user_email_login" placeholder="Email" required>
<input type="password" id="user_pass_word_login" name="user_pass_word_login" placeholder="Password" required>
<input type="submit" class="submit_user_login_form_button" id="submit_user_login_form_button" name="submit_registration_form_button" value="Log In">
</form>
</body>
</html>
这是 home.php
<!DOCTYPE html>
<?php
session_start();
if(!isset($_SESSION['username'])) {
header('Location: index.php');
}
?>
<html>
<head>
</head>
<body>
<?php
echo $_SESSION["success"];
?>
<?php if (isset($_SESSION['username'])) : ?>
<p>Welcome <?php echo $_SESSION['username']; ?>
<br><br>
<form action="logout.php" method="post">
<input type="submit" id="logoutbutton" name="logoutbutton" class="logoutbutton" value="Logout">
</form>
<?php endif ?>
</body>
</html>
这是verify_login_form.php
<!DOCTYPE html>
<?php
session_start();
if($_SERVER['REQUEST_METHOD'] != 'POST') {
header("Location: index.php");
}else{
$connection = mysqli_connect("localhost", "root", "", "websiteusers");
if(!$connection) {
echo "Could not connect to MYSQL database";
}else{
echo "Sucessfully connected to MYSQL database";
$connection = mysqli_connect("localhost", "root", "", "websiteusers");
$useremail = mysqli_real_escape_string($connection,
$_POST["user_email_login"]);
$userpassword = mysqli_real_escape_string($connection,
$_POST["user_pass_word_login"]);
$query = "SELECT * FROM websiteusers WHERE UserEmail='$useremail' AND UserPassWord='$hasheduserpassword'";
$results = mysqli_query($connection, $query);
if(mysqli_num_rows($results) == 1) {
$_SESSION['username'] = $username;
$_SESSION['success'] = "You are now logged in";
header("Location: home.php");
}else{
echo "Email/Username combination is incorrect";
}
}
}
?>
<html>
<head>
</head>
<body>
</body>
</html>
您不能直接比较散列密码。你需要password_verify改用。改变：
$hasheduserpassword = password_hash($userpassword, PASSWORD_DEFAULT);
$query = "SELECT * FROM websiteusers WHERE UserEmail='$useremail' AND UserPassWord='$hasheduserpassword'";
$results = mysqli_query($connection, $query);
if(mysqli_num_rows($results) == 1) {
类似于：
$query = "SELECT * FROM websiteusers WHERE UserEmail='$useremail'";
$results = mysqli_query($connection, $query);
if(mysqli_num_rows($results) == 1 && $row = mysqli_fetch_assoc($results) && password_verify($userpassword, $row['UserPassWord'])) {
这样做的原因password_hash()是使用随机盐来增强散列安全性，并且生成的散列包含此盐。password_verify()从此散列中提取盐，并使用相同的盐对比较字符串进行散列，结果（如果两个密码相同）在相同的散列中，而password_hash()第二次使用会导致使用不同的随机盐，这不会生成相同的散列，因此比较将失败（感谢@Aurelien 的解释）。
请注意，即使使用mysqli_real_escape_string也不会使您完全不受 SQL 注入的影响，您应该改用准备好的语句。
本文收集自互联网，转载请注明来源。
如有侵权，请联系[email protected] 删除。
我来说两句