使用PHP和mysqli进行简单但安全的用户注册

Question

对于像我这样的非高级用户，很难理解、提取和应用高级用户从this或this等帖子中提供的所有建议。

我需要一个简单但安全的MySQLi和PHP用户注册(用户名+密码)；我试图遵循这些帖子中包含的建议，但我不确定我的代码是否安全，不会被注入，以及它是否过时：

Registration.php：

$host = "localhost";
$dbuser = "xxxx";
$dbpassword = "xxxx";
$dbname = "xxxx";

$conn = mysql_connect($host, $dbuser, $dbpassword);
if($conn == 0){
    echo "Connection Failed";
}

$db_select = mysqli_select_db($dbname, $conn);

$username = mysqli_real_escape_string($_POST['username']);
$password = $POST['password'];

if($user == '' or $password == ''){
    echo "Compile all!";
}else{
    $query = "Insert Into 'user' ('username' , 'password') VALUES ('$username' , '$password')";
    $query2 = mysqli_query($query);
    echo "Registration complete";
}

当然，它需要很多改进，我希望理解您的所有建议，因为我是新手。

Answer 1

您需要与您的函数保持一致，mysql_*函数不能与mysqli_*函数互换。坚持使用mysqli_*函数并阅读有关prepared statements的内容，它们将有助于防止注入。

至于密码，您需要知道的第一件事是不要将密码存储在数据库中。这意味着它是纯文本的。如果您可以使用PHP5.5 +，请阅读与散列密码直接相关的these functions，您可以通过将其存储在数据库中。

Answer 2

这是我用来注册的注册码。它工作得很好。

<?php include('header.php'); ?>

<?php
include('config.php');  // Database connection and settings

error_reporting(E_ALL);
ini_set('display_errors', 1);


if(isset($_POST['register'])){

$name = trim(mysqli_escape_string($conn,$_POST['username']));
$first_name = trim(mysqli_escape_string($conn,$_POST['first_name']));
$last_name = trim(mysqli_escape_string($conn,$_POST['last_name']));
$display_name = trim(mysqli_escape_string($conn,$_POST['display_name']));
$email = trim(mysqli_escape_string($conn,$_POST['email']));
$passwords = trim(mysqli_escape_string($conn,$_POST['password']));
$password = password_hash($passwords, PASSWORD_DEFAULT); // for Better Hashing Password

or $password = md5($passwords);

$query_verify_email = "SELECT * FROM users WHERE email ='$email'";
$verified_email = mysqli_query($conn,$query_verify_email) or die("Error: ".mysqli_error($conn));
if (!$verified_email) {
echo ' System Error';
}
if (mysqli_num_rows($verified_email) == 0) {
// Generate a unique code:
$hash = md5(uniqid(rand(), true));
$query_create_user = "INSERT INTO users ( username, email, password, hash,first_name,last_name,display_name,pic,gender,isactive) 
VALUES ( '$name', '$email', '$password', '$hash','$first_name','$last_name','$display_name','','',0)";
$created_user = mysqli_query($conn,$query_create_user) or die("Error: ".mysqli_error($conn));
if (!$created_user) {
echo 'Query Failed ';
}

if (mysqli_affected_rows($conn) == 1) { //If the Insert Query was successfull.

$subject = 'Activate Your Email';

$headers = "From: admin@infotuts.com \r\n";
$headers .= "MIME-Version: 1.0\r\n";
$headers .= "Content-Type: text/html; charset=ISO-8859-1\r\n";
$url= 'verify.php?email=' . urlencode($email) . "&key=$hash";

$message ='<p>To activate your account please click on Activate buttton</p>';
$message.='<table cellspacing="0" cellpadding="0"> <tr>';
$message .= '<td align="center" width="300" height="40" bgcolor="#000091" style="-webkit-border-radius: 5px; -moz-border-radius: 5px; border-radius: 5px;

color: #ffffff; display: block;">';

$message .= '<a href="'.$url.'" style="color: #ffffff; font-size:16px; font-weight: bold; font-family: Helvetica, Arial, sans-serif; text-decoration: none;

line-height:40px; width:100%; display:inline-block">Click to Activate</a>';
$message .= '</td> </tr> </table>';

mail($email, $subject, $message, $headers);

echo '<div class="alert alert-success">A confirmation email
has been sent to <b>'. $email.' </b> Please click on the Activate Button to Activate your account </div>';
} else { // If it did not run OK.
echo '<div class="alert alert-info">You could not be registered due to a system
error. We apologize for any
inconvenience.</div>';
die(mysqli_error($conn));
}
}
else{
echo '<div class="alert alert-danger">Email already registered</div>';}
}
?>
<div class="row">
    <div class="col-xs-12 col-sm-8 col-md-6 col-sm-offset-2 col-md-offset-3">
        <form role="form" action='' method="post" enctype="multipart/form-data">
            <h2>Please Sign Up <small>It's free and always will be.</small></h2>
            <hr class="colorgraph">
            <div class="row">
                <div class="col-xs-12 col-sm-6 col-md-6">
                    <div class="form-group">
                        <input type="text" name="first_name" id="first_name" class="form-control input-lg" placeholder="First Name" tabindex="1">
                    </div>
                </div>
                <div class="col-xs-12 col-sm-6 col-md-6">
                    <div class="form-group">
                        <input type="text" name="last_name" id="last_name" class="form-control input-lg" placeholder="Last Name" tabindex="2">
                    </div>
                </div>
            </div>
            <div class="form-group">
                <input type="text" name="username" id="username" class="form-control input-lg" placeholder="User Name" tabindex="3">
            </div>
            <div class="form-group">
                <input type="text" name="display_name" id="display_name" class="form-control input-lg" placeholder="Display Name" tabindex="3">
            </div>
            <div class="form-group">
                <input type="email" name="email" id="email" class="form-control input-lg" placeholder="Email Address" tabindex="4">
            </div>
            <div class="row">
                <div class="col-xs-12 col-sm-6 col-md-6">
                    <div class="form-group">
                        <input type="password" name="password" id="password" class="form-control input-lg" placeholder="Password" tabindex="5">
                    </div>
                </div>
                <div class="col-xs-12 col-sm-6 col-md-6">
                    <div class="form-group">
                        <input type="password" name="password_confirmation" id="password_confirmation" class="form-control input-lg" placeholder="Confirm Password" tabindex="6">
                    </div>
                </div>
            </div>
            <div class="row">
                <div class="col-xs-4 col-sm-3 col-md-3">
                    <span class="button-checkbox">
                        <button type="button" class="btn" data-color="info" tabindex="7">I Agree</button>
                        <input type="checkbox" name="t_and_c" id="t_and_c" class="hidden" value="1">
                    </span>
                </div>
                <div class="col-xs-8 col-sm-9 col-md-9">
                     By clicking <strong class="label label-primary">Register</strong>, you agree to the <a href="#" data-toggle="modal" data-target="#t_and_c_m">Terms and Conditions</a> set out by this site, including our Cookie Use.
                </div>
            </div>

            <hr class="colorgraph">
            <div class="row">
                <div class="col-xs-12 col-md-6"><input type="submit" name='register' value="Register" class="btn btn-primary btn-block btn-lg" tabindex="7"></div>
                <div class="col-xs-12 col-md-6"><a href="login.php" class="btn btn-success btn-block btn-lg">Sign In</a></div>
            </div>
        </form>
    </div>
</div>
</div>

Answer 3

你的代码有相当多的问题。主要问题是您正在使用过时的数据库连接方法(mysql_*函数)。您还可以尝试与它交换mysqli_*函数。我的建议是你放弃这些代码，学习PDO。我确信它将成为更新的PHP版本中的标准(至少我是这么被告知的)。

除此之外，您正在检查数据库连接是否有效，但即使不是有效的，代码也会继续执行并运行查询。如果您不太担心UX，如果数据库连接失败，那么您可以直接调用die($string)；这将杀死脚本并回显一个字符串。另外，'or‘不是有效的运算符。它||代表或。您引用的超级全局变量也是错误的。它是“$_POST”，而不是“$POST”。你也没有散列密码。你应该查找如何散列密码，但要注意破解算法，如md5等。我通常倾向于使用随机字节盐的加密。关于哪一个是最好的，有很大的争论。但总体而言，如果你编写了一个好的系统，那么你就不应该太担心数据是“非散列”的(错误的术语)。

我希望这对你有所帮助。我的建议是，在沉迷于登录系统等可能会将用户数据置于危险境地的项目之前，要多学习PHP。