php - 登录/注册想打印电子邮件

Question

我在我的网站上做了一个登录和注册选项。现在我想在个人资料页面上打印电子邮件。现在，当我尝试打印出电子邮件数据时，它是空的。这是我登录会话的服务器端代码。请注意，这是一个学校项目，所以我只需要展示一个原型，因此安全性不是问题。我只需要展示它的外观！

    <?php
session_start();

// initializing variables
$username = "";
$email    = "";
$errors = array(); 

// connect to the database
$db = mysqli_connect('localhost', 'root', '', 'registration');

// REGISTER USER
if (isset($_POST['reg_user'])) {
  // receive all input values from the form
  $username = mysqli_real_escape_string($db, $_POST['username']);
  $email = mysqli_real_escape_string($db, $_POST['email']);
  $password_1 = mysqli_real_escape_string($db, $_POST['password_1']);
  $password_2 = mysqli_real_escape_string($db, $_POST['password_2']);

  // form validation: ensure that the form is correctly filled ...
  // by adding (array_push()) corresponding error unto $errors array
  if (empty($username)) { array_push($errors, "Username is required"); }
  if (empty($email)) { array_push($errors, "Email is required"); }
  if (empty($password_1)) { array_push($errors, "Password is required"); }
  if ($password_1 != $password_2) {
    array_push($errors, "The two passwords do not match");
  }

  // first check the database to make sure 
  // a user does not already exist with the same username and/or email
  $user_check_query = "SELECT * FROM users WHERE username='$username' OR email='$email' LIMIT 1";
  $result = mysqli_query($db, $user_check_query);
  $user = mysqli_fetch_assoc($result);

  if ($user) { // if user exists
    if ($user['username'] === $username) {
      array_push($errors, "Username already exists");
    }

    if ($user['email'] === $email) {
      array_push($errors, "email already exists");
    }
  }

  // Finally, register user if there are no errors in the form
  if (count($errors) == 0) {
    $password = md5($password_1);//encrypt the password before saving in the database

    $query = "INSERT INTO users (username, email, password) 
              VALUES('$username', '$email', '$password')";
    mysqli_query($db, $query);
    $_SESSION['username'] = $username;
    $_SESSION['email'] = $email;
    $_SESSION['id'] = $id;
    $_SESSION['success'] = "Je bent nu ingelogd";
    header('location: index.php');
  }
}
//login user
if (isset($_POST['login_user'])) {
  $username = mysqli_real_escape_string($db, $_POST['username']);
  $password = mysqli_real_escape_string($db, $_POST['password']);
  if (empty($username)) {
    array_push($errors, "Username is required");
  }
  if (empty($password)) {
    array_push($errors, "Password is required");
  }

  if (count($errors) == 0) {
    $password = md5($password);
    $query = "SELECT * FROM users WHERE username='$username' AND password='$password' AND email='$email'";
    $results = mysqli_query($db, $query);
    if (mysqli_num_rows($results) == 1) {
      $_SESSION['username'] = $username;
      $_SESSION['email'] = $email;
      $_SESSION['id'] = $id;
      $_SESSION['success'] = "You are now logged in";
      header('location: index.php');
    }else {
        array_push($errors, "Wrong username/password combination");
    }
  }
}

?>

这是我在个人资料页面上使用的代码。它打印出用户名就好了

        <div class="col s6">username</div>
        <div class="col s6"><?php echo $_SESSION['username']; ?></div>
        <div class="col s6">E-Mail</div>
        <div class="col s6"><?php echo $_SESSION['email']; ?></div>

标签： php

Answer 1

您的问题是您没有在正常登录时询问电子邮件，而是在登录查询中使用它。

最初您设置为$email = '';，当您在查询中使用它时，您将不会通过该查询找到用户帐户，因为它是一个空字符串，因此登录总是会失败。

所以只用用户名查询数据库。然后检查密码而不是在查询中使用它。

使用查询返回的数据来设置您的会话。

我还修改了这个查询以使用参数化的准备查询。防止SQL 注入攻击

<?php
session_start();

// initializing variables
$username = "";
$email    = "";
$errors = array(); 

// connect to the database
$db = mysqli_connect('localhost', 'root', '', 'registration');

// REGISTER USER
if (isset($_POST['reg_user'])) {
  // receive all input values from the form
  $username = mysqli_real_escape_string($db, $_POST['username']);
  $email = mysqli_real_escape_string($db, $_POST['email']);
  $password_1 = mysqli_real_escape_string($db, $_POST['password_1']);
  $password_2 = mysqli_real_escape_string($db, $_POST['password_2']);

  // form validation: ensure that the form is correctly filled ...
  // by adding (array_push()) corresponding error unto $errors array
  if (empty($username)) { array_push($errors, "Username is required"); }
  if (empty($email)) { array_push($errors, "Email is required"); }
  if (empty($password_1)) { array_push($errors, "Password is required"); }
  if ($password_1 != $password_2) {
    array_push($errors, "The two passwords do not match");
  }

  // first check the database to make sure 
  // a user does not already exist with the same username and/or email
  $user_check_query = "SELECT * FROM users WHERE username='$username' OR email='$email' LIMIT 1";
  $result = mysqli_query($db, $user_check_query);
  $user = mysqli_fetch_assoc($result);

  if ($user) { // if user exists
    if ($user['username'] === $username) {
      array_push($errors, "Username already exists");
    }

    if ($user['email'] === $email) {
      array_push($errors, "email already exists");
    }
  }

  // Finally, register user if there are no errors in the form
  if (count($errors) == 0) {
    $password = md5($password_1);//encrypt the password before saving in the database

    $query = "INSERT INTO users (username, email, password) 
              VALUES('$username', '$email', '$password')";
    mysqli_query($db, $query);
    $_SESSION['username'] = $username;
    $_SESSION['email'] = $email;
    $_SESSION['id'] = $id;
    $_SESSION['success'] = "Je bent nu ingelogd";
    header('location: index.php');
  }
}
//login user
if (isset($_POST['login_user'])) {
    if (empty($username)) {
        array_push($errors, "Username is required");
    }
    if (empty($password)) {
        array_push($errors, "Password is required");
    }

    if (count($errors) == 0) {

        $query = "SELECT * FROM users WHERE username=?";
        $stmt = $db->prepare($query);
        $stmt->bind_param('s', $_POST['username']);
        $stmt->execute();

        $row = $stmt->fetch_assoc();

        if ($row['password'] == md5($_POST['password']) {

            $_SESSION['username']   = $row['username'];
            $_SESSION['email']      = $row['email'];
            $_SESSION['id']         = $row['id'];
            $_SESSION['success']    = "You are now logged in";

            header('location: index.php');
            exit;
        }else {
            array_push($errors, "Wrong username/password combination");
        }
    }
}
?>

请不要滚动您自己的密码哈希，特别是不要使用 MD5() 或 SHA1()。PHP 提供password_hash() 并password_verify()请使用它们。这里有一些关于密码的好主意 如果你使用的是 5.5 之前的 PHP 版本，这里有一个兼容包

但由于这实际上不是问题的一部分，所以我暂时忽略它。