为什么允许不存在的用户使用这段脚本登录? - Why are users who do not exist allowed to login using this bit of script?

Why are users who do not exist allowed to login using this bit of script?

我有一些PDO:

if (empty($this->user->username) || empty($this->user->password))
    throw new Exception("Error Processing Request", 1);
include('dbconnect.php');       // Normally I'd store the db connect script outside of webroot
$pdo = new PDO("mysql:host=$db_host;dbname=$db_name;", $db_user, $db_password);
$stmt = $pdo->prepare('SELECT userFName FROM Users WHERE username = ? AND password = ? AND roleID = 1');
$stmt->bindParam(1, $this->user->username);
$stmt->bindParam(2, $this->user->password);
$stmt->bindColumn(1, $userFName, PDO::PARAM_STR);
try {
    $stmt->execute();
}
catch (PDOException $e) {
    echo 'Invalid username or password: ' . $e->getMessage();
}
$stmt->fetch(PDO::FETCH_BOUND);
$this->user->firstName = $userFName;

如果post的用户名和/或密码错误，仍然会发生登录。我认为PDO有问题;当我试图检查$this->user->密码对数据库中的记录时，我错过了一些关键的东西吗?

(顺便说一句，我正在使用加密)

$stmt->execute();

如果没有结果，

不会抛出异常。您需要检查查询结果是否为用户返回了一行。

编辑:

$stmt->execute();
if ($stmt->rowCount() > 0) {
    //user found
} else {
    //user not found
}