php登录don'；不起作用 - php login don't work

php login don't work

本文关键字：不起作用登录 don php | 更新日期: 2023-09-27

我正在开发一个登录系统，如果用户输入了错误的用户名&密码将他返回到登录页面，如果可以重定向到admin/index.php，它就不起作用，也没有错误。

功能代码和html代码

    if(isset($_POST['submit_form'])){
        $username = mysqli_real_escape_string($_POST['username']);
        $password = mysqli_real_escape_string($_POST['password']);
        $query = mysqli_query("SELECT * FROM users WHERE username = '$username' AND   password ='{$password'");
        if($query==false){
            set_message(" Your password or username are wrong ");
            redirect("login.php");
        }else{
            redirect("admin");
        }
    }

Html代码

<form class="form-inline" role="form" action="" method="post" enctype="multipart/form-data">
    <div class="form-group">        
        <label class="form-group" for="username">username</label>
        <input type="text" name="username" class="form-control" id="username" placeholder="username">
    </div>
    <div class="form-group">
        <label class="sr-only" for="password">Password</label>
        <input type="password" name="password" class="form-control" id="password" placeholder="password">
    </div>
    <button type="submit" name="submit_form" class="btn btn-black">
    <input type="hidden" name="submit_form" value="<?php echo session_id()"/>
        Login
    </button>
</form>

的功能

function redirect($location) {
    header("Location : $location"); 
}
function query($sql){
    global $connection ;
    return mysqli_query($connection, $sql);
}
function confirm($result){
    global $connection;
    if(!$result){
        die("QUERY FAILED " . mysqli_error($connection));
    } 
}
function escape_string($string){
    global $connection ;
    return mysqli_real_escape_string($connection, $string);
}

是的，对不起，我只是习惯了这件事。谢谢你指出错误。

    //this will eliminate the BOT hitting up the forms
    if(isset($_POST['submit_form']) && $_POST['submit_form']==session_id()){
    $username = mysql_real_escape_string($_POST['username']);
    $password = mysql_real_escape_string($_POST['password']);
    $query = mysqli_query("SELECT * FROM users WHERE username = '$username' AND   password ='$password'");
    if($query==false){
        set_message(" Your password or username are wrong ");
        redirect("login.php");
    }else{
        redirect("admin");
    }
}

我也更新了表格。

  <form class="form-inline" role="form" action="" method="post" enctype="multipart/form-data">
<div class="form-group">        
    <label class="form-group" for="username">username</label>
    <input type="text" name="username" class="form-control" id="username" placeholder="username">
</div>
<div class="form-group">
    <label class="sr-only" for="password">Password</label>
    <input type="password" name="password" class="form-control" id="password" placeholder="password">
</div>
<button type="submit" name="submit_form" class="btn btn-black">
    Login
</button> <input type="hidden" name="submit_form" value="<?php echo session_id()"/>

在解析查询时，我会使用sprintf。它消除了SQL注入。你可以这样做：

      $query = sprintf('SELECT * FROM TABLE WHERE username = "%s" AND password = "%s"',
      mysql_real_escape_string($username),
      mysql_real_escape_string($password));

希望这对你有用。