PHP條件不起作用

Question

我有這個代碼

$nick = $_POST["user"];
$pass = sha1($_POST["pass"]);

$user = pg_query($dbconn, "SELECT * FROM users");
$user = pg_fetch_object($user);

if($user->nick != $nick || $user->pass != $pass) {
    echo 'Wrong user or password';
}

數據庫中的nick是字符類型，並且已經很雜湊，但是我仍然在輸出中得到“用戶名或密碼錯誤”。

有類型沖突嗎？

Answer 1

$nick = $_POST["user"];
$pass = sha1($_POST["pass"]);

$user = pg_query($dbconn, "SELECT * FROM users WHERE nick = '$nick' and pass='$pass'");
$num = pg_num_rows($user);
$user = pg_fetch_object($user);

if($num==0) {
    echo 'Wrong user or password';
}

當以客戶將要交互的某些值進行查詢時，請確保他不會使用某些注入方法

更改代碼：

$nick = pg_escape_string(strip_tags($_POST["user"]));
$pass = sha1($_POST["pass"]);