PHP未正确检测会话变量值


PHP not detecting session variable value properly

我正在尝试进行PHP登录,如果登录则显示注销按钮,如果未登录则显示登录表单

    <?php if ($_SESSION["login"] == "1") { ?>
        <form class="form-signin" method="post">
            <h2 class="form-signin-heading">You are signed in!</h2>
            <input type="hidden" name="op" value="logout">
            <button class="btn btn-lg btn-primary btn-block" type="submit">Log out</button>
        </form>
    <?php } else { ?>
        <form class="form-signin" method="post">
            <h2 class="form-signin-heading">Sign in</h2>
            <input type="text" class="form-control" placeholder="Username" name="user" required="" autofocus="" style="margin:2px 0">
            <input type="password" class="form-control" placeholder="Password" name="pass" required="" style="margin:2px 0">
            <input type="hidden" name="op" value="login">
            <button class="btn btn-lg btn-primary btn-block" type="submit">Sign in</button>
        </form>
    <?php }; ?>

以下是启动会话并设置变量login:的代码

if (isset($_REQUEST["user"]) && isset($_REQUEST["pass"]) && isset($_REQUEST["op"]) && $_REQUEST["op"] == "login") {
                $user = $_REQUEST["user"];
                $pass = $_REQUEST["pass"];
                $con = mysql_connect("localhost", USER, PASS);
                if (!$con) {
                    die("Could not connect: " . mysql_error());
                }
                mysql_select_db("reddit", $con);
                $sql = mysql_query("SELECT username from t120937_users WHERE t120937_users.username = '" . $user . "' AND t120937_users.password = '" . $pass . "';");
                if (mysql_num_rows($sql) > 0) {
                    session_start();
                    $_SESSION["login"] = "1";
                    header("Location: /~rauno.sams/");
                } else {
                    echo "Incorrect login information :(";
                }
                mysql_close($con);
            }
            if(isset($_REQUEST["op"]) && $_REQUEST["op"] == "logout") {
                $_SESSION["login"] = "";
                session_destroy();
                header("Location: /~rauno.sams/");
            }

然而,每次都会显示登录表单,我不知道为什么。

您的select语句有一个额外的;所以你的mysql_num_rows是0,这不会让你登录。