通过AJAX / MySql / PHP登录

Question

Basically I want to check a database to see if the username and password are a match if so unlock the submit button.

<?php
mysql_connect('localhost', '', '');
mysql_select_db('database');
if(isset($_POST['submit'])){
    mysql_query("SELECT username,password FROM table WHERE username='".$_POST['username']."',password='".$_POST['password']."'")
}
?>

Form:

<form method="post">
Username <input type="text" name="username" />
Password <input type="password" name="password" />
<input type="submit" name="submit" value="Login" />
</form>

Answer 1

1. What's your question? You forgot to actually ask one ;)
2. You need to, at a minimum, escape strings with mysql_real_escape_string() before inserting them into a query. Otherwise you're ripe for SQL injection
3. Saving passwords in plain text is generally inadvisable. Hash and salt .
4. There are already auth libraries out there that do most of this for you, and protect you against a whole host of other issues you've not yet heard of. Don't reinvent a wheel that's been built many times before by much more experienced people. Evaluate packages like PEAR_Auth

Answer 2

I don't know if i get you right but anyway try :

HTML:

  <form method="post">
     Username <input type="text" id="username" name="username" />
     Password <input type="password" id="password" name="password" />
    <input type="submit" name="submit" id="submit" value="Login" />
 </form>

jQuery:

    $("#submit").hide();
    $.post("checkUsername.php", { username: $("#username").val(), password: $("#password").val() }, function(result) {
 if(result == "true") { $("#submit").fadeIn(fast); }

 });

Php ( checkUsername.php ):

if(mysql_num_rows(mysql_query("SELECT username,password FROM table WHERE username LIKE '". mysql_real_escape_string($_POST['username']) . "',password LIKE '".mysql_real_escape_string($_POST['password'])."'")))
    {
       echo "true";
    }
    else
    {

    echo "false";
    }

Answer 3

You should avoid using the LIKE keyword for a login prompt like this, since wildcards are unaffected by mysql_real_escape_string. A user can log in with a username and password of "%".

See the following blog post: http://blog.spiderlabs.com/2012/03/like-omg.html

Use = instead of LIKE.