PHP登录-if（empty）$ password在我的代码中不起作用，为什么？

Question

So I was playing around with my simple login system, and one thing I can't seem to figure out is why the login allows me to create an account with only an username and send this data to my database event though I specified

 if($_SERVER['REQUEST_METHOD'] == 'POST') {
$username = mysql_real_escape_string($_POST['username']);
$password = mysql_real_escape_string(md5($_POST['password']));

and

    if(empty($username)) {
      echo("Du ma fylle inn et brukernavn!");
} {
 if(empty($password)) {
      echo("Du ma fylle inn et passord!");
      } else {

When I remove (md5 in the escape string, it works, but then there is no encryption and the password is visible in the database. So it's kind of vice versa.. anyone see where my mistake or missunderstanding is?

QUICK SUM: It's supposed to give "You need to fill in password" but it doesn't when I have the md5 decrypting in the string, however when I remove it, it allows me.

Answer 1

md5 will result in a string, even though the input is empty. You need to check the original input, straight from $_POST . If you want to validate input, always check before processing it, as subsequent processing (as you have seen in this case) can result in non-empty variables, even though the original input was empty.

Answer 2

md5 will encode ANYTHING, even an empty string. Which will make the variable 'non-empty', no matter what.

Meaning: Do your check on empty first, THEN encode your password.

Answer 3

空字符串仍然具有MD5哈希，因此您可以正确检查密码是否相等。

Answer 4

You could check if the field is empty before you assign md5-

if($_SERVER['REQUEST_METHOD'] == 'POST') 
{
    if (mysql_real_escape_string(empty($_POST['password']))) {
        // do nothing
    } 
    else 
    {
   `    $username = mysql_real_escape_string($_POST['username']);
        $password = mysql_real_escape_string(md5($_POST['password']));

        if(empty($username)) {
             echo("Du ma fylle inn et brukernavn!");
        } {
        if(empty($password)) {
             echo("Du ma fylle inn et passord!");
        } else {
        }
   }

}