登录错误密码和用户名组合

Question

<?php
session_start();

$db =mysqli_connect("localhost", "root", "","registration" );
if (isset($_POST['login_btn'])){
    $username = mysql_real_escape_string($_POST ['username']);
    $password = mysql_real_escape_string($_POST ['password']);

    $password= md5($password);
    $sql = "SELECT * FROM users WHERE username= '$username' AND password= '$password'";
    $result = mysqli_query($db, $sql);
if(mysqli_num_rows($result) == 1 ){
$_SESSION['message']= "You are now logged in";
$_SESSION['username'] = $username;

header("Location: home.php");
}else{
    $_SESSION['message'] = "Username and  password combination is incorrect";
}

}
?>

<html>
<head>

</head>
<body>
<div class="header"> <h1>login</h1></div>

<?php
if (isset($_SESSION['message'])){
    echo "<div id = 'error_msg>".$_SESSION['message']."</div>";
    unset($_SESSION['message']);
}
?>

<form method="post" name="loginform" action="login.php">
    <table>
        <tr>
            <td> Username:</td>
            <td><input type = "text" name="username" placeholder="Username" class="textInput"  required></td>
        </tr>

        <tr>
            <td> Password:</td>
            <td><input type = "password" placeholder="Password"  name="password" class="textInput" required></td>
        </tr>

        <tr>
            <td></td>
            <td><input type = "submit" name="login_btn" value="Login"></td>
        </tr>
    </table>
</form>
</body>

</html>

Hi guys, this is my login page with PHP.大家好，这是我使用 PHP 的登录页面。 Apart from logging in it allows passwords which are not the same.除了登录之外，它还允许使用不同的密码。 According to the code its set to check if the two passwords are matching and if they aren't, it displays an error.根据代码，它设置为检查两个密码是否匹配，如果不匹配，则显示错误。

This one doesn't display an error even if the two passwords don't match.即使两个密码不匹配，这个也不会显示错误。 Why does it allows a user to log in with wrong passwords??为什么它允许用户使用错误的密码登录？？

I want it to display an error when passwords don't match and in return doesn't allow logging in because of wrong credentials.我希望它在密码不匹配时显示错误，并且由于凭据错误而不允许登录。

Answer 1

You are not using mysql_real_escape_string properly.您没有正确使用mysql_real_escape_string 。 You should use either mysqli_real_escape_string or use mysql_connect to connect to MySQL.您应该使用mysqli_real_escape_string或使用mysql_connect连接到 MySQL。

mysql_real_escape_string 's second parameter is assumed automatically if mysql_connect is used, but you are using mysqli_connect instead, that's why it's not finding any connection.如果使用mysql_connect则mysql_real_escape_string的第二个参数会自动假定，但您使用的是mysqli_connect ，这就是它找不到任何连接的原因。

From pph website it states:从 pph 网站它指出：

The MySQL connection. MySQL 连接。 If the link identifier is not specified, the last link opened by mysql_connect() is assumed.如果未指定链接标识符，则假定为mysql_connect()打开的最后一个链接。 If no such link is found, it will try to create one as if mysql_connect() had been called with no arguments.如果没有找到这样的链接，它会尝试创建一个链接，就好像mysql_connect()没有被调用一样。 If no connection is found or established, an E_WARNING level error is generated.如果未找到或建立连接，则会生成E_WARNING级别错误。

Reference: http://php.net/manual/en/function.mysql-real-escape-string.php参考： http : //php.net/manual/en/function.mysql-real-escape-string.php

Try changing尝试改变

 $username = mysql_real_escape_string($_POST ['username']);
 $password = mysql_real_escape_string($_POST ['password']);

to到

$username = mysqli_real_escape_string($db, $_POST ['username']);
$password = mysqli_real_escape_string($db, $_POST ['password']);

登录错误密码和用户名组合

问题描述

1 个解决方案

解决方案1
0 2018-11-09 04:39:24

登录错误密码和用户名组合

问题描述

1 个解决方案

解决方案1 0 2018-11-09 04:39:24

解决方案1
0 2018-11-09 04:39:24