$_SESSION 登录脚本：不验证 SQL 数据库中的用户

Question

My database setup is like so:

create database if not exists shop;
use shop;
create table if not exists users(
 id serial primary key,
 username varchar(20),
 password char(20));    

create table if not exists admins(
 id serial primary key,
 username varchar(20),
 password char(20));

insert into admins values(null, 'admin', SHA('touch'));

and my main problem exists with the login_process page.

<?php
 $username = $_POST['username'];
 $password = $_POST['password'];

 $db=mysqli_connect("localhost","root","","shop")or die(mysqli_error($db));
 $q="select * from admins where username='$username' and password=SHA('$password')";
 $results=mysqli_query($db, $q)or die(mysqli_error($db));
 if(mysqli_num_rows($results) > 0)
 {
  session_start();
  $_SESSION['username']=$username;
  header("Location:index.php");
  exit(0);
 }
 else
 {
   header("Location:login.php");
   exit(0);
 }
?>

When the page tries to validate my admin, instead of the location heading to index.php, it instead stays on login.php and the admin credentials never validate. The same problem persists in my login and register process pages with their respective roles.

Answer 1

MySQL's SHA function return 40 hex digits string. The password field need to handle 40 characters to make SHA works.

Answer 2

Address the issues by following

type session_start on the login page & declare $_SESSION variables as ''

$q="select * from admins where username='$username' and password=SHA('$password')"; echo this query & run on backend,see if it returns data?

So if the above query returns data then sure redirection will be on index page