时间戳

首页 > 解决方案 > 即使密码或用户名不正确，我的 PHP 登录系统仍在登录

php - 即使密码或用户名不正确，我的 PHP 登录系统仍在登录

问题描述

即使用户名和密码错误仍然可以登录，即使值为空也可以登录

<?php 

    $hostname = "localhost";
    $username = "root";
    $password = "";
    $dbname = "login";
    $conn = mysqli_connect($hostname, $username, $password, $dbname);
    if (!$conn) {
        die ("unable to connect");
    }

    if ($_POST) {
        $uname = $_POST ["username"];
        $pass = $_POST ["password"];

        $sql = "SELECT * FROM users WHERE username = '$uname' AND password = '$pass' LIMIT 1 ";
        $result = mysqli_query($conn, $sql);
        if (mysqli_num_rows($result) == 1){
            include("graph.php");
        } else {
            echo "Incorrect"; 
        }
    }
 ?>

标签： phpauthentication

解决方案

首先非常重要的是，您对 SQL 注入攻击持开放态度，因此您应该使用准备好的语句，这是应该如何使用您的代码，但echo "Incorrect";您应该为每种情况提供不同的答案：

<?php

    $hostname = "localhost";
    $username = "root";
    $password = "";
    $dbname = "login";
    $conn = mysqli_connect($hostname, $username, $password, $dbname);
    if (!$conn) {
        die ("unable to connect");
    }

    if (isset($_POST["username"]) && isset($_POST["password"])) { // Check if you have posted data via POST
        $uname = $_POST["username"];
        $pass = $_POST["password"];

        $sql = "SELECT * FROM users WHERE username = ? AND password = ? LIMIT 1 ";

        if($stmt = $conn->prepare($sql)) { // Check for MySQL errors
            $stmt->bind_param('ss', $uname, $pass);
            if ($stmt->execute()) {
                $stmt->close();
                include("graph.php");
            } else { // There is a problem with your SELECT // bind params
                echo "Incorrect";
            }
        } else { // You should handle mysql errors here
            echo "Incorrect";
        }
    } else { // You don't have POST data
        echo "Incorrect";
    }
 ?>

准备好的报表

就像@Kuya 注意到你有很多其他问题一样，谷歌有很多关于实现登录系统的教程。

推荐阅读