允许用户使用用户名和密码以及4位数的密码登录

Question

我想用用户名密码和4位PIN码登录用户，并且代码在我的数据库中。 这是我的代码示例。 如果这里有人可以帮助我，我将非常感谢：

<?php
if (isset($_POST['login'])) {
    $user = $_POST['user'];
    $pass = $_POST['pass'];
    $pincode = $_POST['pincode'];

    if (empty($user)  OR empty($pincode)) {
        echo "<script>alert('Please Fill All Required Field')</script>";
    } else {
        $select_user = "select * from users WHERE  Username = '$user' AND Password ='$pass' pin-code ='?' ";
        $run_user_sql = mysqli_query($conn, $select_user);
        $check_customer = mysqli_num_rows($run_user_sql);

        if ($check_customer ==false) {
            echo "<script>alert('Username/Password Wrong')</script>";
            exit();
        }

        if ($check_customer  == true) {
            $_SESSION['user'] = $user; 
            echo "<script>alert('You Are Logged In')</script>";
            echo "<script>window.open('index.php?dashboard','_self')</script>";
        }
    }
}
?>


<form action="" method="post">
    <div class="form-group">
        <div class="form-label-group">
            <input type="text" class="form-control" name="user" placeholder="Username" >
            <label">Username</label>
        </div>
    </div>

    <div class="form-group">
        <div class="form-label-group">
            <input type="password"  class="form-control" name="pass" placeholder="Password" >
            <label >Password</label>
        </div>
    </div>

    <div class="form-group">
        <div class="form-label-group">
            <input type="text" class="form-control" name="pincode" placeholder="4-Digit Pin Code" >
            <label >4-Digit Pin Code</label>
        </div>
    </div>

    <div class="form-group">
        <div class="checkbox">
            <label>
                <input type="checkbox" value="remember-me">
                Remember Password
            </label>
        </div>
    </div>
    <input type="submit" class="btn btn-primary btn-block" name="login" value="Login">
</form>

Answer 1

您的代码似乎还可以，但是存在很多安全风险。 但是，您的SQL命令是错误的。 将其更改为以下内容：

$select_user = "select * from users WHERE Username = '$user' AND Password ='$pass' AND `pin-code` ='{$pincode}'";