[英]Change Password in PHP
我在PHP中有一個更改密碼腳本,我想做的是從用戶輸入的上一個屏幕中獲取變量,然后將其與mysql數據庫進行比較。 如果舊密碼與他們輸入的密碼不匹配,我希望它失敗並顯示錯誤。 這是我到目前為止的代碼。但是我知道將字符串與變量進行比較是行不通的,但是需要知道如何將它們轉換以便可以進行比較。 以下是有問題的頁面。
密碼當前存儲在數據庫上的Plain txt中,但稍后將更改為md5。 問題是如何比較輸入值和從數據庫中提取的值?
<html>
<head>
<title>Password Change</title>
</head>
<body>
<?php
mysql_connect("localhost", "kb1", "BajyXhbRAWSVKPsA") or die(mysql_error());
mysql_select_db("kb1") or die(mysql_error());
$todo=mysql_real_escape_string($_POST['todo']);
$username=mysql_real_escape_string($_POST['userid']);
$password=mysql_real_escape_string($_POST['password']);
$password2=mysql_real_escape_string($_POST['password2']);
$oldpass=mysql_real_escape_string($_POST['oldpass']);
/////////////////////////
if(isset($todo) and $todo == "change-password"){
//Setting flags for checking
$status = "OK";
$msg="";
//MYSQL query to pull the current password from the database and store it in $q1
$results = mysql_query("SELECT password FROM kb_users WHERE username = '$username'") or die(mysql_error());
$q1 = mysql_fetch_array($results);
//print_r($q1)
//changing the string $oldpass to using the str_split which converts a string to an array.
//$oldpass1 = str_split($oldpass,10);
if(!$q1)
{
echo "The username <b>$username</b> does not exist in the database. Please click the retry button to attempt changing the password again. <BR><BR><font face='Verdana' size='2' color=red>$msg</font><br><center><input type='button' value='Retry' onClick='history.go(-1)'></center>"; die();
}
if ($oldpass == $q1){
$msg = $msg. "The provided password <b>$oldpass</b> is not the same as what is in the database. Please click the retry button to attempt changing the password again.<BR><br>";
$status = "NOTOK";}
/*
if ($q1 <> $oldpass1) {
$msg = $msg. "The provided password <b>$oldpass</b> is not the same as what is in the database. Please click the retry button to attempt changing the password again.<BR><br>";
$status = "NOTOK"; }
*/
if ( strlen($password) < 3 or strlen($password) > 10 ){
$msg=$msg. "Your new password must be more than 3 char legth and a maximum 10 char length<BR><BR>";
$status= "NOTOK";}
if ( $password <> $password2 ){
$msg=$msg. "Both passwords are not matching<BR>";
$status= "NOTOK";}
if($status<>"OK")
{
echo "<font face='Verdana' size='2' color=black>$msg</font><br><center> <input type='button' value='Retry' onClick='history.go(-1)'></center>";
}
else {
// if all validations are passed.
if (mysql_query("UPDATE kb_users SET password='$password' where username='$username'") or die(mysql_error()));
{
echo "<font face='Verdana' size='2' ><center>Thanks <br> Your password has been changed successfully. Please keep changing your password for better security</font></center>";
}
}
}
?>
</body>
</html>
首先,不建議直接在查詢中使用POST數據。 您最好先轉義此數據,以避免注入。
另外,我認為您使用if的方法也不是最好的方法。 我認為不需要狀態變量。 在這種情況下,這是肯定的。 在測試值之前,將$status
設置為NOTOK
。 因此,它將始終為NOTOK
,這將導致您的腳本永遠不會更新任何密碼。
我認為,我將測試的結構更改為更好的測試。 好好看一下您要測試的內容,因為現在您的測試已經混在一起了。
<html>
<head>
<title>Password Change</title>
</head>
<body>
<?php
// MySQL connection details
$todo=mysql_real_escape_string($_POST['todo']);
$username=mysql_real_escape_string($_POST['userid']);
$password=mysql_real_escape_string($_POST['password']);
$password2=mysql_real_escape_string($_POST['password2']);
$oldpass=mysql_real_escape_string($_POST['oldpass']);
if(isset($todo) and $todo == "change-password"){
$results = mysql_query("SELECT password FROM kb_users WHERE username = '$username'") or die(mysql_error());
$q1 = mysql_fetch_array($results);
if (!$q1) {
// The user does not exist in the database.
}
if ($oldpass == $q1) {
// The current password matches the input from the oldpass field.
if (strlen($password) > 3 or strlen($password) < 10) {
// Password meets requirements
if ($password == $password2) {
//Passwords match, update the password in the database
}
else {
// The new passwords do not match.
}
}
else {
// Password is too short / long
}
}
}
?>
</body>
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.