PHP / MySQL登录系统-

Question

I'm pretty new to both PHP and MySQL and I'm struggling to get my login system to function properly. The registration works fine, but when I run the login it doesn't recognise there is anything within the table matching the entered data. Below is the code I believe to be the problem area.

Thanks in advance.

<?php

function load($page = 'login.php')
{
$url = 'http://'.$_SERVER['HTTP_HOST'].
dirname($_SERVER['PHP_SELF']);
$url = rtrim($url,'/\/');
$url.= '/'.$page;

header("location:$url");
exit();
} 
function validate($dbc,$email ='',$pwd='')
{
$errors = array();
if (empty($email))
    { $errors[] = 'Enter your email address.'; }
else
    {  $e = mysqli_real_escape_string($dbc,trim($email));}
if (empty($pwd))
    { $errors[] = 'Enter your password.';}
else
    { $p = mysqli_real_escape_string($dbc, trim($pwd)); }
if (empty($errors))
{
    $q = "SELECT adultID, FirstName, Surname "
            . "FROM adult_information "
            . "WHERE Email = '$e' AND Password = SHA1('$p')";
    $r = mysqli_query($dbc, $q);

    if (mysqli_num_rows($r) == 1)
    { $row = mysqli_fetch_array($r, MYSQLI_ASSOC);
        return array( true, $row);}
    else
    {$errors[]='Email address and password not found.';}
}
return array(false,$errors);
}

Answer 1

I believe that you'll get what you're looking for if you change

$q = "SELECT adultID, FirstName, Surname "
        . "FROM adult_information "
        . "WHERE Email = '$e' AND Password = SHA1('$p')";

to

$p = SHA1($p);

$q = "SELECT adultID, FirstName, Surname "
        . "FROM adult_information "
        . "WHERE Email = '$e' AND Password = '$p'";

Whenever a PHP-to-MySQL query isn't performing as expected, my first step is to get a look at the SQL I'm actually passing to the database. In this case, it would be by inserting a line like echo '<p>$q</p>'; immediately after assigning the value of $q.

Sometimes it immediately becomes obvious that I've got a malformed query just by looking at it. If it doesn't, I copy the SQL code that appears and run it as a query within the database manager, to see what errors it throws and/or examine the resulting data.