停止绕过登录页面

Question

我有这个作为我的登录页面：

    <!DOCTYPE html>
<!--PHP login System by WEBDEVTRICK (https://webdevtrick.com) -->
<html>
<head>
<meta charset="utf-8">
<title>Login | Webdevtrick.com</title>
<link rel="stylesheet" href="style.css" />
</head>
<body>
<?php
require('config.php');
session_start();
if (isset($_POST['username'])){
    $username = stripslashes($_REQUEST['username']);
    $username = mysqli_real_escape_string($link,$username);
    $password = stripslashes($_REQUEST['password']);
    $password = mysqli_real_escape_string($link,$password);
        $query = "SELECT * FROM `users` WHERE username='$username'
and password='".md5($password)."'";
    $result = mysqli_query($link,$query) or die(mysql_error());
    $rows = mysqli_num_rows($result);
        if($rows==1){
        $_SESSION['username'] = $username;
        header("Location: inventory.php");
         }else{
    echo "<div class='form'>
<h3>Username/password is incorrect.</h3>
<br/>Click here to <a href='login.php'>Login</a></div>";
    }
    }else{
?>
    <form class="login" action="" method="post" name="login">
    <h1 class="login-title">Login | Webdevtrick.com</h1>
    <input type="text" class="login-input" name="username" placeholder="Username" autofocus>
    <input type="password" class="login-input" name="password" placeholder="Password">
    <input type="submit" value="Login" name="submit" class="login-button">
  <p class="login-lost">New Here? <a href="registration.php">Register</a></p>
  </form>

<?php } ?>
</body>
</html>

这是我的 auth.php 脚本，我包含在我的页面中：

<?php
session_start();
if(!isset($_SESSION["username"])){
header("Location: login.php");
exit(); }
?>

现在，无论我是否登录，我都可以转到inventory.php。 如何确保我只能在登录时执行此操作？

Answer 1

您的脚本容易受到SQL 注入的攻击，您不应该只使用session.start()因为它也不安全。

相反，您应该使用Prepared Statement

简单地说，准备好的语句是一种准备 MySQL 调用的方式，而不存储变量。

安全的 PHP 登录示例

<?php
include 'session.php'; // Secure Session Script
if(isset($_POST['username'])){
   include 'database.php';

   $username=$_POST['username']; 
   $password=$_POST['password'];

   $sql="SELECT * FROM login WHERE Username = ?";

   $stmt = $conn->prepare($sql); 
   $stmt->bind_param("s",$username); // As much "s" as variables to bind are
   $stmt->execute();
   $result = $stmt->get_result()->fetch_assoc();
   if ($result && password_verify($password, $result['password']))
   {
      $_SESSION['login']= $username;
      header('Location: Success.php');
   } else {
      header('Location: index.php');
      $_SESSION['error'] = 'Invalid Credentials';
      exit();
   }
} else {
   header('Location: index.php');
   exit();
}
?>

安全会话

<?php
ini_set('session.use_only_cookies', 1); // Prevents the session ID from appearing in a referer header
session_set_cookie_params(0,'/','localhost',false,true); // Determines the duration of cookies
session_start(); // Start Session
session_regenerate_id(); // Regenerate Session ID 
?>

最终... Success.php

<?php
include '../functions/s-session.php';
if (!isset($_SESSION['login'])) { // if login is not set then...
  header("Location: index.php");
  exit();
}
?>
// html page