使用SQL检查数据库中是否存在用户


Use SQL to check if user exists in database

我试图检查一个名为members的表,看看是否存在一个用户的电子邮件和密码。我能够连接到数据库,但由于某种原因,它跳所有这些if语句和回声'You have been logged in!',即使我把错误的电子邮件或密码?下面是html和php:

<form action="/login-user" method="POST">
    Email: <input type="text" name="login_email"><br>
    Password: <input type="password" name="login_password"><br>
    <button type="submit">Login</button>
</form>
PHP:

<?php
    session_start();
    /*error_reporting(0);*/
    require 'users/functions/user-functions.php';
    require 'users/connect-database.php';
    if (empty($_POST) === false) {
        $email = mysqli_real_escape_string($connection, $_POST['login_email']);
        $password = stripslashes(mysqli_real_escape_string($connection, $_POST['login_password']));
        $encrypted_password = md5($password);
        if (empty($email)) {
            echo 'You need to enter an email<br>';
        } else if (empty($password)) {
            echo 'You need to enter a password<br>';
        } else if(user_exists($connection, $email, $encrypted_password) === false) {
            echo 'You don''t seem to be registered?';
        } else if (user_active($connection, $email, $encrypted_password) === false) {
            echo 'You haven''t activated your account!';
        } else {
            $login = login($connection, $email, $encrypted_password);
            if ($login === false) {
                echo 'That email/password combination is incorrect';
            } else {
                $_SESSION['user_id'] = $login;
                $_SESSION['logged_in'] = true;
                echo 'You have been logged in!';
            }
        }
    /*print_r($errors);*/
} else {
    echo 'inputs were empty<br>';
}
require 'users/disconnect-database.php';
?>

'user-functions.php'文件内容:

<?php
    function sanitize($connection, $data) {
        return mysqli_real_escape_string($connection, $data);
    }
    function logged_in() {
        return $_SESSION['logged_in'];
    }
    function user_exists($connection, $email, $password) {
        $query = mysqli_num_rows(mysqli_query($connection, "SELECT * FROM members WHERE email = '$email' AND password = '$password'"));
        return ($query > 0) ? true : false;
    }
    function user_active($connection, $email, $password) {
        $query = mysqli_query($connection, "SELECT user_id FROM members WHERE email = '$email' AND password = '$password' AND `active` = 1");
        return ($query !== false) ? true : false;
    }
    function return_user_id($connection, $email, $password) {
        return mysqli_query($connection, "SELECT user_id FROM members WHERE email = '$email' AND password = '$password'");
}
    function login($connection, $email, $password) {
        /*$user_id = mysql_result(mysqli_query($connection, "SELECT user_id FROM members WHERE email = '$email' AND password = '$password'"), 0, 'user_id');*/
        /*$password = md5($password);*/
        $query = mysqli_query($connection, "SELECT user_id FROM members WHERE email = '$email' AND password = '$password'");
        /*return (mysqli_query($connection, $query) or die (false));*/
        if ($query === false) {
            return false;
        } else {
            return $query;
        }
    /*return ($query !== false) ? true : false;*/
    }
    function log_out() {
        unset($_SESSION['logged_in']);
        session_unset();         
        session_destroy();
    }
?>

如果答案是使用mysql_resultmysqli_result,请详细解释,因为即使阅读了手册和W3Schools以及其他地方,我仍然不明白这些功能是如何工作的。

谢谢你的回答,顺便说一下,我 have 读了所有关于这个东西的帖子,但我没有找到任何答案。谢谢。

首先,我建议使用sha加密密码,因为md5很快就会被解密。

为您的登录功能尝试以下操作:

<?php
function login($connection, $email, $password) {
    $query = mysqli_query($connection, "SELECT `email`, `password` FROM `members` WHERE `email` = '$email' AND `password` = '$password'");
    $count = mysqli_num_rows($query); //counting the number of returns
    //if the $count = 1 or more return true else return false
    if($count >= 1) {
        return true;
    } else {
        return false;
    }
}
?>

在脚本返回true之后,您可以设置会话或对它做您需要做的事情。

EDIT您需要session_start在每个文件中,所以最好的做法是包括它。我希望这个工作,我打得很快,所以可能有一些错误,但请让我知道:

<?php
function generate($password) {
    $password = hash('sha1', $password);
    return $password;
}
function login($connection, $email, $password) {
    $password = generate($password);
    $query = mysqli_query($connection, "SELECT `email`, `password` FROM `members` WHERE `email` = '$email' AND `password` = '$password'");
    $count = mysqli_num_rows($query); //counting the number of returns
    //if the $count = 1 or more return true else return false
    if($count >= 1) {
        return true;
    } else {
        return false;
    }
}
function exists($connection, $detail, $table, $row, $value) {
    $query = mysqli_query($connection, "SELECT `$detail` FROM `$table` WHERE `$row` = '$value'");
    $count = mysqli_num_rows($query);
    if($count >= 1) {
        return true;
    } else {
        return false;
    }
}
function detail($connection, $detail, $table, $row, $value) {
    $query = mysqli_query($connection, "SELECT `$detail` FROM `$table` WHERE `$row` = '$value'");
    $associate = mysqli_fetch_assoc($query);
    return $associate[$detail];
}
function errors($error) {
    echo '<ul class="error">';
    foreach($error as $fault) {
        echo '<li>'.$fault.'<li>';
    }
    echo '</ul>';
}
function isLoggedIn() {
    if(!empty($_SESSION['logged_in']) && exists($connection, 'id', 'members', 'id', $_SESSION['logged_in']) == true) {
        return true;
    } else {
        return false;
    }
}
function logout() {
    unset($_SESSION['logged_in']);
}
if($_POST) {
    $email = mysqli_real_escape_string($connect, strip_tags($_POST['email']));
    $password = mysqli_real_escape_string($connect, strip_tags($_POST['password']));
    if(!empty($email) && !empty($password)) {
        if(!filter_var($email, FILTER_VALIDATE_EMAIL)) {
            $error[] = 'Your email: '.$email.' is not valid';
        }
        if(exists($connection, 'email', 'members', 'email', $email) == false) {
            $error[] = 'You are not registered';
        }
        if(detail($connection, 'active', 'members', 'email', $email) != 1) {
            $error[] = 'Your account is not activated';
        }
        if(empty($error)) {
            $query = login($connection, $email, $password);
            if($query == true) {
                $_SESSION['logged_in'] == detail($connection, 'id', 'members', 'email', $email);
            }
        }
    } else {
        $error[] = 'There are empty fields';
    }
    if(!empty($error)) {
        echo errors($error);
    }
}
?>
<form action="" method="POST">
    Email: <input type="text" name="email"><br>
    Password: <input type="password" name="password"><br>
    <input type="submit" value="Login">
</form>