PHP登录问题

Question

我正在创建一个链接到数据库的登录名，当输入信息时，登录名会运行一个空白页面，什么也不做，以下是我的代码：

    include "conn.php";
    session_start();

    $email_address = $_POST['email_address'];
    $password = $_POST['password'];

    if ($email_address && $password)
    {
    $connect = mysql_connect("computing","i7906890","password") or die ("couldn't   connect!");
    mysql_select_db("i7906890") or die ("couldn't find database");
$guery = mysql_query("SELECT * FROM UserAccount WHERE email_address = '$email_address'");

if ($numrows!=0) {
   //code to login
   while ($row = mysql_fetch_assoc($query)) //Password Check
   {
       $dbemail_address = $row['email_address']
       $dbpassword = $row['password']
   }
   //Check if they match
   if ($email_address==$dbemail_address&&$password==$dbpassword)
   {
      echo "You're in! <a href='user_page.php'>click</a> here to enter the members page";
      $_SESSION['user']==$dbemail_address;
   }
   else
      echo "Incorrect Password!";
}
else
   die("That user doesn't exist!");
}
else
   die("Please enter an email address and password!"); 
?>

这也是我的表格

<form action = "login2.php" method ="POST">
        <p><img src="images/space.gif" width="70px" height="1px"/><strong>Log in</strong> or <a href="register_form.php"><strong>Register</strong></a><br>
            Email:<img src="images/space.gif" width="34px" height="1px"/><input type="text" name="user" size="33"> <br>
            Password:<img src="images/space.gif" width="10px" height="1px"/><input type="password" name="password" size="33"> <br>
        <div align="center">
        <input type="submit" value="Log in" class="button">
        </div>
    </p>
    </form>

请帮帮我！SOS

Answer 1

您的代码中缺少一些;，这会导致脚本崩溃，并且不会显示任何内容。(特别是在while循环中，但也要在其他地方检查。)

编辑:为了获得更好的性能，您可能还需要考虑去掉所有的while循环，并将密码标准放在SQL语句中。就像另一个发帖者所说的那样，要小心SQL注入。

Answer 2

Please help! SOS是的，你在深水中...但不是你所期望的.

即使你的代码运行良好，你也是第五或第六个提出大致相同问题的人，在使用过时的mysql_函数的PHP登录表单中充满了SQL injection……

而且，$guery和$query...也不一样检查q和g字母...

这一行：

$guery = mysql_query("SELECT * FROM UserAccount WHERE email_address = '$email_address'");

应该至少是

$query = mysql_query("SELECT * FROM UserAccount WHERE email_address = '".mysql_real_escape($email_address)."'");

既要正确，又要避免注射...

但是你真的应该通过PDO使用语句，如下所示：

try {
    //open connection, this is different than in the old functions
    $dbh = new PDO('mysql:host=localhost;dbname=test', $user, $pass);

    //***running query
    //**step1: create statement
    $stmt = $dbh->prepare('SELECT * FROM UserAccount WHERE email_address = :email'); //notice parameter prefixed with ':'

    //**step2: bind values (be sure to also check out the bindParameter() function too!)
    $stmt->bindValue(':email', $email_address);

    //**step3: exexcute statement
    $stmt->execute();

    //**step4: process results
    $result = $stmt->fetch(PDO::FETCH_OBJ);

    if($result->PASSWORD==$password) {
      //logged in, do whatever reuqired
    }

    $dbh = null; //don't let it slip out of our hands
} catch (PDOException $e) {
    print "Error!: " . $e->getMessage() . "<br/>";
    die();
}

此外，另一个需要注意的问题是:不要存储明文密码。如今，甚至连存储MD5散列都超出了范围，而且SHA1也被宣布为弱...