PHP 管理员和用户帐户不起作用


php admin and user account doesn't work

我有一个登录表单。我的数据库表中有两条记录:管理员和用户。如果您登录,如果管理员,则必须转到admin_area.php。这是行不通的,如果用户,他总是登录。如果您登录,如果用户这样做。脚本的第一部分不起作用,无法运行。

有人可以帮助我吗?提前谢谢。

<?php
//first part: this is not working
session_start();
//if (isset($_POST['submit'])) {
$a_username = $_POST ['username'];
$a_password = md5( $_POST ['password']);
if($a_username == "admin" && $a_password=="intel")
{
    include 'connect.php';
    $sqli = "SELECT * FROM users WHERE username='$a_username' AND password='$a_password' ";
    $numrows = mysqli_query($link, $sqli)    or    die(mysqli_error());
        $username = 'username';
        $password = 'password';
        //Add some stripslashes
        $username = stripslashes($username);
        $password = stripslashes($password);
        //Check if username and password is good, if it is it will start session
        if ($username == $a_username && $password == $a_password)
        {
            $_SESSION['username'] = 'true';
            $_SESSION['username'] = $username;
            //Redirect to admin page
            header("Location: admin_area.php");exit();
        }
}
//second part: this works
$username = $_POST ['username'];
$password = md5( $_POST ['password']);
if($username&&$password)
{
include 'connect.php';
$query = "SELECT * FROM users WHERE username='$username' AND password='$password' ";
$numrows = mysqli_query($link, $query)    or    die(mysqli_error());
if ($numrows != 0)
{
    /
    while ($row = mysqli_fetch_assoc ($numrows))
    {
        $dbusername  = $row['username'];
        $dbpassword  = $row['password'];
    }
        if ($username==$dbusername&&$password==$dbpassword)
        {
            echo "you are log in <a href='user.php'>click here for contine</a>, after 4 seconds"; header('Refresh: 4;url=user.php'); 
            $_SESSION ['username'] = $username;
        }
        else
         echo "<h3>incorrect password,  <a href='index.php'>click here</a></h3>";
}
else 
    die ("text");

}
else 
    die ("text");
//}
?>
$a_password = md5( $_POST ['password']);
if($a_username == "admin" && $a_password=="intel")

此条件无效,因为

$a_password = md5( $_POST ['password']) 

首先转换为 MD5 格式,然后选中$a_password=="intel" $a_password现在是 md5 格式,intel是普通字符串。对于此,首先尝试匹配正常$a_password例如

$a_password = $_POST ['password'] 

并将变量写入条件中,如下所示

$a_password = md5( $_POST ['password'])