登录时访问被拒绝

Question

我有一个买家表格，称为“ Buyer.php”：

<form method="post" action="check_buyer.php" id="LoggingInBuyer">
    <div style="width:265px;margin:0; padding:0; float:left;">
    <label>Username:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span><a href="#">Forgot Username?</span></a></label> <br />
    <input id="UserReg" style="width:250px;" type="text" name="userName" tabindex="1" class="required" /></div>
    <div style="width:265px;margin:0; padding:0; float:right;">
    <label>Password:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span><a href="#">Forgot Password?</span></a></label> <br />
    <input id="UserReg" style="width:250px;" type="password"  name="userPass" tabindex="2" class="required" /></div>
    <div class="clearB"> </div>
    <input type="submit" style="width:100px; margin:10px 200px;" id="UserRegSubmit" name="submit" value="Login" tabindex="3" />
</form>

名为check_buyer.php的文件（在同一目录中）：

<?php
session_start(); #recall session from index.php where user logged include()

function isLoggedIn()
{
    if(isset($_SESSION['valid']) && $_SESSION['valid'])
        header( 'Location: buyer/' ); # return true if sessions are made and login creds are valid
    echo "Invalid Username and/or Password";  
    return false;
}

require_once('../inc/db/dbc.php');

$connect = mysql_connect($h, $u, $p) or die ("Can't Connect to Database.");
mysql_select_db($db);

$LoginUserName = $_POST['userName'];
$LoginPassword = mysql_real_escape_string($_POST['userPass']);
//connect to the database here
$LoginUserName = mysql_real_escape_string($LoginUserName);
$query = "SELECT uID, uUPass, dynamSalt, uUserType FROM User WHERE uUName = '$LoginUserName';";

function validateUser($ifUserExists['uID'], $ifUserExists['uUserType']) {
    $_SESSION['valid'] = 1;
    $_SESSION['uID'] = $uID;
    $_SESSION['uUserType'] = $uUserType; // 1 for buyer - 2 for merchant
}

$result = mysql_query($query);
if(mysql_num_rows($result) < 1) //no such USER exists
{
    echo "Invalid Username and/or Password";
}
$ifUserExists = mysql_fetch_array($result, MYSQL_ASSOC);

$dynamSalt = $ifUserExists['dynamSalt'];  #get value of dynamSalt in query above
$SaltyPass = hash('sha512',$dynamSalt.$LoginPassword); #recreate originally created dynamic, unique pass

if($SaltyPass != $ifUserExists['uUPass']) # incorrect PASS
{
    echo "Invalid Username and/or Password";
}else {
    validateUser();
}
// If User *has not* logged in yet, keep on /login
if(!isLoggedIn())
{
    header('Location: index.php');
    die();
}
?>

//现在抛出以下错误：解析错误：语法错误，第23行上的意外'['，期望'）'，它是function validateUser($ifUserExists['uID'], $ifUserExists['uUserType']) {

并在Buyer /目录中添加文件“ index.php”：

<?php
session_start();
if($_SESSION['uUserType']!=1)
{ 
    die("You may not view this page. Access denied.");
}

function isLoggedIn()
{
    return (isset($_SESSION['valid']) && $_SESSION['valid']);
}

//if the user has not logged in
if(!isLoggedIn())
{
    header('Location: index.php');
    die();
}
?>

<?php 
    if($_SESSION['valid'] == 1){
        #echo "<a href='../logout.php'>Logout</a>";
        require_once('buyer_profile.php');
    }else{
        echo "<a href='../index.php'>Login</a>";
    }
?>

这样做的目的是，输入用户名和密码后，用户将登录并定向到/buyer/index.php ，并指向该网站的buyer部分。 似乎每次我使用测试用的虚拟凭据登录时，它都会脱口而出： You may not view this page. Access denied You may not view this page. Access denied 。 但是，如果我按浏览器中的向后箭头返回，则可以logged in并showing a link to logout 。

我进行了一些故障排除：1）如图所示，测试我的sql query是否正常，确实如此。 http://i.stack.imgur.com/n2b5z.png

2）尝试choing echo 'the userid: ' . $userid; echo 'the userid: ' . $userid; 在它发出哀鸣之前， You may not view..并且它不会打印任何内容。

我该如何获取该userID ？ 我仔细检查了数据库中的字段名称，一切都很好。

Answer 1

通过快速检查，您似乎在validateUser()设置了$_SESSION['uUserType'] = $userType ，但似乎没有将$userType本身传递给该函数。 因此$_SESSION['uUserType']不会为1 ，而$_SESSION['valid']将会为1，因为您是在validateUser()中将其设置为该值。

我怀疑您应该将有效数据传递给validateUser以便将其设置为会话。

例如

validateUser($ifUserExists['uID'], $ifUserExists['uUserType']);

function validateUser($uID, $uUserType) {
    $_SESSION['valid'] = 1;
    $_SESSION['uID'] = $uID;
    $_SESSION['uUserType'] = $uUserType; // 1 for buyer - 2 for merchant
}