没有正确密码登录...如何解决？

Question

I am building a Login page for my website. I have used Dreamweaver to create the login code. I don't know a lot about php, but when I login using an incorrect password (but correct username) it allows me into a restricted part of the site.

For example: suppose the correct username is test and the correct username is test123. When a user types in "test" for the username and types in any letter (though if you type in a number it doesn't let you through) for the password it logs them in and allows them through. This would be bad...

Is there a way to make sure the site checks that both the password and username are correct?

I don't know hardly anything about php. So any help would be greatly appreciated.

Here is my login code:

<?php
require_once('Connections/--------_userdatabase.php');

if (!function_exists("GetSQLValueString")) {
    function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = ""){
    if (PHP_VERSION < 6) {
        $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;
    }

    $theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);

    switch ($theType) {
        case "text":
            $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
            break;    
        case "long":
        case "int":
            $theValue = ($theValue != "") ? intval($theValue) : "NULL";
            break;
        case "double":
            $theValue = ($theValue != "") ? doubleval($theValue) : "NULL";
            break;
        case "date":
            $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
            break;
        case "defined":
            $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
            break;
    }
    return $theValue;
}


// *** Validate request to login to this site.
if (!isset($_SESSION)) {
    session_start();
}

$loginFormAction = $_SERVER['PHP_SELF'];
if (isset($_GET['accesscheck'])) {
    $_SESSION['PrevUrl'] = $_GET['accesscheck'];
}

if (isset($_POST['username'])) {
    $loginUsername=$_POST['username'];
    $password=$_POST['password'];
    $MM_fldUserAuthorization = "";
    $MM_redirectLoginSuccess = "http://www.-----------.org";
    $MM_redirectLoginFailed = "http://www.-----------.org/login.php";
    $MM_redirecttoReferrer = false;
    mysql_select_db($database_-------_userdatabase, $--------_userdatabase);

    $LoginRS__query=sprintf("SELECT Username, Password FROM userdatabase WHERE Username=%s AND Password=%s",
    GetSQLValueString($loginUsername, "int"), GetSQLValueString($password, "int")); 

    $LoginRS = mysql_query($LoginRS__query, $--------_userdatabase) or die(mysql_error());
    $loginFoundUser = mysql_num_rows($LoginRS);
    if ($loginFoundUser) {
        $loginStrGroup = "";

        if (PHP_VERSION >= 5.1) {
            session_regenerate_id(true);
        } else {
            session_regenerate_id();
        }
        //declare two session variables and assign them
        $_SESSION['MM_Username'] = $loginUsername;
        $_SESSION['MM_UserGroup'] = $loginStrGroup;       

        if (isset($_SESSION['PrevUrl']) && false) {
            $MM_redirectLoginSuccess = $_SESSION['PrevUrl'];    
        }
        if ($loginUsername === 'Admin') {
            header("Location: http://www.------------.org/user/-------/");
        } else if ($loginUsername === 'User') {
            header("Location: http://www.------------.org/user/-------/");
        } else if ($loginUsername === 'User2') {
            header("Location: http://www.-----------.org/user/--------/");
        } else {
            header("Location: " . $MM_redirectLoginSuccess );
        }
    } else {
        header("Location: ". $MM_redirectLoginFailed );
    }
}
?>

Answer 1

You must add die(); after a header() redirect, as header() only sends a header to the browser, without really knowing what it means. It then continues to serve the content as usual, if you don't have die() after it.

Partial example

<?php
if ($loginFoundUser) {
 // Put the cut out code back in
 if (isset($_SESSION['PrevUrl']) && false) {
  $MM_redirectLoginSuccess = $_SESSION['PrevUrl']; 
 }
 if ($loginUsername === 'Admin') {
  header("Location: http://www.------------.org/user/-------/");
  die;
 } else if ($loginUsername === 'User') {
  header("Location: http://www.------------.org/user/-------/");
  die;
 } else if ($loginUsername === 'User2') {
  header("Location: http://www.-----------.org/user/--------/");
  die;
 } else {
  header("Location: " . $MM_redirectLoginSuccess );
  die;
 }
} else {
 header("Location: ". $MM_redirectLoginFailed );
 die;
}
?>

Also, it appears you're converting the values to INT before checking the values in the database, which should not be done (considering a valid $loginUsername is 'Admin'). This can be changed with the following code:

GetSQLValueString($loginUsername, "string"), GetSQLValueString($password, "string"));

Answer 2

Is the following link the restricted area?

http://www.------------.org/user/-------/