我在这段代码上遇到了特别麻烦。自从我上一个问题以来，我已经完全使用 sql 重做了我的选择，但是当我回显 mysqli_error（$con）;
简而言之，当在代码底部附近创建表时，回显"内容"区域是问题所在。 如果当前登录用户的"层"（来自备用表：成员）大于或等于原始 opwire 表中的"seclevel"值，则它应该仅回显名为 opwire 的表的"内容"区域。如果小于，则应该回显"拒绝访问"。
我现在所拥有的破坏了表格，错误检查什么也没给出。在主表 php 下面，我还包含了所有函数.php。我是否错过了关于$userTier的东西; 我也无法从中得到回声。
<?php
include_once 'functions.php';
include_once 'db_connect.php';
sec_session_start();
if(login_check($mysqli) == true) {
$con=mysqli_connect("localhost","myuser","mypass","mysqldb");
// Check connection
if (mysqli_connect_errno())
{
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
function getColor($strOption)
{
switch ($strOption)
{
case "Case 1":
return "#cbae80";
case "Case 2":
return "#e59350";
case "Case 3":
return "#b7aaa4";
}
}
$query= "SELECT tier FROM members WHERE id = $user_ID";
$result = mysqli_query($con,$query);
$row = mysqli_fetch_array($result);
$userTier = $row['tier'];
$query = "SELECT category, contents, date, username
FROM opwire LEFT JOIN members on opwire.userid=members.id
WHERE seclevel <= $userTier
UNION
SELECT category, 'ACCESS DENIED' AS contents, date, username
FROM opwire LEFT JOIN members on opwire.userid=members.id
WHERE seclevel > $userTier
ORDER BY date DESC";
$result = mysqli_query($con,$query);
echo "<table border='1'>
<tr>
<th>Category</th>
<th>Contents</th>
<th>Date/Time</th>
<th>Operative</th>
</tr>";
while($row = mysqli_fetch_array($result))
{
echo "<tr>";
echo "<td><font size=1 color='".getColor($row['category'])."'> " . $row['category'] . "</font></td>";
echo "<td><font size=1 color=#e4d6b5>" . $row['contents'] . "</font></td>";
echo "<td><font size=1 color=silver>" . $row['date'] . "</font></td>";
echo "<td><font size=1 color=gold>" . $row['username'] . "</font></td>";
echo "</tr>";
}
echo "</table>";
mysqli_close($con);
}
else {
echo 'Access to this area requires security clearance. <br/>';
}
?>
和函数.php，处理所有会话/用户控制
<?php
function sec_session_start() {
$session_name = 'sec_session_id'; // Set a custom session name
$secure = false; // Set to true if using https.
$httponly = true; // This stops javascript being able to access the session id.
ini_set('session.use_only_cookies', 1); // Forces sessions to only use cookies.
$cookieParams = session_get_cookie_params(); // Gets current cookies params.
session_set_cookie_params($cookieParams["lifetime"], $cookieParams["path"], $cookieParams["domain"], $secure, $httponly);
session_name($session_name); // Sets the session name to the one set above.
session_start(); // Start the php session
session_regenerate_id(); // regenerated the session, delete the old one.
}
function login($email, $password, $mysqli) {
// Using prepared Statements means that SQL injection is not possible.
if ($stmt = $mysqli->prepare("SELECT id, username, password, salt FROM members WHERE email = ? LIMIT 1")) {
$stmt->bind_param('s', $email); // Bind "$email" to parameter.
$stmt->execute(); // Execute the prepared query.
$stmt->store_result();
$stmt->bind_result($user_id, $username, $db_password, $salt); // get variables from result.
$stmt->fetch();
$password = hash('sha512', $password.$salt); // hash the password with the unique salt.
if($stmt->num_rows == 1) { // If the user exists
// We check if the account is locked from too many login attempts
if(checkbrute($user_id, $mysqli) == true) {
// Account is locked
// Send an email to user saying their account is locked
return false;
} else {
if($db_password == $password) { // Check if the password in the database matches the password the user submitted.
// Password is correct!
$user_browser = $_SERVER['HTTP_USER_AGENT']; // Get the user-agent string of the user.
$user_id = preg_replace("/[^0-9]+/", "", $user_id); // XSS protection as we might print this value
$_SESSION['user_id'] = $user_id;
$username = preg_replace("/[^a-zA-Z0-9_'-]+/", "", $username); // XSS protection as we might print this value
$_SESSION['username'] = $username;
$_SESSION['login_string'] = hash('sha512', $password.$user_browser);
// Login successful.
return true;
} else {
// Password is not correct
// We record this attempt in the database
$now = time();
$mysqli->query("INSERT INTO login_attempts (user_id, time) VALUES ('$user_id', '$now')");
return false;
}
}
} else {
// No user exists.
return false;
}
}
}
function checkbrute($user_id, $mysqli) {
// Get timestamp of current time
$now = time();
// All login attempts are counted from the past 2 hours.
$valid_attempts = $now - (2 * 60 * 60);
if ($stmt = $mysqli->prepare("SELECT time FROM login_attempts WHERE user_id = ? AND time > '$valid_attempts'")) {
$stmt->bind_param('i', $user_id);
// Execute the prepared query.
$stmt->execute();
$stmt->store_result();
// If there has been more than 5 failed logins
if($stmt->num_rows > 5) {
return true;
} else {
return false;
}
}
}
function login_check($mysqli) {
// Check if all session variables are set
if(isset($_SESSION['user_id'], $_SESSION['username'], $_SESSION['login_string'])) {
$user_id = $_SESSION['user_id'];
$login_string = $_SESSION['login_string'];
$username = $_SESSION['username'];
$user_browser = $_SERVER['HTTP_USER_AGENT']; // Get the user-agent string of the user.
if ($stmt = $mysqli->prepare("SELECT password FROM members WHERE id = ? LIMIT 1")) {
$stmt->bind_param('i', $user_id); // Bind "$user_id" to parameter.
$stmt->execute(); // Execute the prepared query.
$stmt->store_result();
if($stmt->num_rows == 1) { // If the user exists
$stmt->bind_result($password); // get variables from result.
$stmt->fetch();
$login_check = hash('sha512', $password.$user_browser);
if($login_check == $login_string) {
// Logged In!!!!
return true;
} else {
// Not logged in
return false;
}
} else {
// Not logged in
return false;
}
} else {
// Not logged in
return false;
}
} else {
// Not logged in
return false;
}
}
?>
从
页面调用时$user_ID不在范围内。它已被塞进会话中，所以要更改。
$query= "SELECT tier FROM members WHERE id = $user_ID";
自
$user_id = $_SESSION['user_id'];
$query = "select tier from members where id = $user_id";
当您使用它时，此查询可能比您当前拥有的联合更有效：
select
category,
case when <= $userTier then contents else 'ACCESS DENIED' end as contents,
date,
username
from
opwire o
left join
members m
on o.userid = m.id
order by
date desc