PHP错误：代码始终返回相同的值

Question

I've made this code to login in to a site, but my code always returns Onjuiste gegevens (incorrect data) . I don't know why.

In my database I have made 1 account with username: sander and password: sander. When I enter this in the form I still get "Onjuiste gegevens". Could someone please help me to fix this?

<?php
$conn = mysqli_connect("localhost", "root", "", "login");


if (isset($_POST['inloggen'])) {
    $username = $_POST['username'];
    $password = $_POST['password'];

    $query = "SELECT * FROM users WHERE username = '$username' AND '$password'";

    $result = mysqli_query($conn, $query);

    if (mysqli_num_rows($result) == 1) {
        echo "Juiste gegevens!";
    } else {
        echo "Onjuiste gegevens!";
    }

    echo "<br />";
}
?>
<form method="post" action="">
    <label>Username</label>
    <input type="text" name="username"/><br />
    <label>Password</label>
    <input type="password" name="password"/><br />

    <input type="submit" name="inloggen" value="Inloggen"/>

</form>

Answer 1

There's a problem with your query , you've missed out password , it should be:

$query = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";

Also, you should prevent MySQL Injection :

$username = mysqli_real_escape_string($conn, $_POST['username']);
$password = mysqli_real_escape_string($conn, $_POST['password']);

Read more about mysqli_real_escape_string() at http://www.w3schools.com/php/func_mysqli_real_escape_string.asp .

Also read up on MySQLi Prepared Statements : http://php.net/manual/en/mysqli.quickstart.prepared-statements.php , it's a good way to prevent MySQL Injection .

Tip: Remember to store passwords hashed for security purposes. Do not store them as plain-text.

Answer 2

您的查询逻辑错误，您忘记了password ：

SELECT * FROM users WHERE username = '$username' AND password='$password'

Answer 3

Your query is not valid. You're forgetting the password column in your database.

$query = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";

Besides having a wrong query, the query is open for sql injections.

Answer 4

Try this

$username = mysqli_real_escape_string($conn, $_POST['username']);
$password = mysqli_real_escape_string($conn, $_POST['password']);

$query = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";

which improves security by using mysqli_real_escape_string() for post variables.

mysqli_real_escape_string() - Escapes special characters in a string for use in an SQL statement,

http://php.net/manual/en/mysqli.real-escape-string.php