如何正确判断返回的数组是否为假?


How do I properly determine if an array that is returned is false?

我正在尝试在我的网站上建立一个密码保护区域。然而,在我的if语句中,我在确定数组是否为空时遇到了麻烦。当代码运行时,不管user/pass字段中输入了什么,它总是被测试为true。作为参考,被访问的数据库只有1行,包含1个user/pass组合。

function verify(){
  $dbhost = "host";
  $dbname = "db";
  $dbuser = "user";
  $dbpass = "password";

  if (isset($_SESSION['valid_user']))return true;
  $user_name = $_POST["user_name"]; 
  $password = $_POST["password"];
  if ($user_name && $password){ 
    try{ 
      $conn = new PDO("mysql:host=$dbhost;dbname=$dbname",$dbuser,$dbpass);
    }
    catch(PDOException $pe){
      die('Connection error, because: ' .$pe->getMessage());
    }
    $sql = "SELECT user_name FROM users WHERE user_name = ':user_name' AND password = ':password'";     
    $q = $conn->prepare($sql);
    if(!$q){
      die("Execute query error, because: ". $conn->errorInfo());
    }; 
    $q->execute(array(':user_name'=>$user_name, ':password'=>$password));  
    $result = $q->fetchALL();
    if ($result['user_name']=$user_name){ 
      $valid_user = $user_name;
      $_SESSION['valid_user'] = $valid_user;
      return true;
    }
    else{  
      $text = "User Name and Password did not match";
      write_log_in($text);
    }
  }
  else {  
    $text = "This is a secure server. Please log in.";
    write_log_in($text);
  }
}

作为旁注,我知道我的密码应该至少以MD5散列格式或类似的格式存储。我只是想在添加更多的东西之前让它工作。

这是你的问题

if ($result['user_name']=$user_name){ 

应该是

if ($result['user_name']==$user_name){ 

但是你为什么不检查你是否有一个结果来确定用户是否正确呢?因为您在SQL查询中传递了用户

缺少等号:

if ($result['user_name'] == $user_name){ 
// ----------------------^

$result['user_name']=$user_name应为$result['user_name'] === $user_name

同样,不要使用MD5。使用慢散列函数(如hash_pbkdf2)对密码进行散列,攻击代价很高。

您可以使用:if (mysql_num_rows($result)==0),因为如果没有结果,则用户输入的passwd不正确