时间戳

首页 > 解决方案 > “更新密码”（更改密码）出现问题

php - “更新密码”（更改密码）出现问题

问题描述

我刚刚做了一个“更改密码”页面，但它没有更新数据库中的密码

我不管我输入什么，它一直说“密码已更改”

感谢您提前提供帮助

问候西蒙

<?php

require_once 'header.php';

session_start();
$con = mysqli_connect('localhost','robinsnest','robinsnest') or die('Unable To connect');
if(count($_POST)>0) {
$result = mysqli_query($con,"SELECT *from members WHERE user='" . $_SESSION["$user"] . "'");
$row=mysqli_fetch_array($result);
if($_POST["currentPass"] == $row["pass"] && $_POST["newPass"] == $row["confirmPass"] ) {
mysqli_query($con,"UPDATE members set pass='" . $_POST["newPass"] . "' WHERE user='" . $_SESSION["$user"] . "'");
$message = "Password Changed Sucessfully";
} else{
 $message = "Password is not correct";
}
}



?>



<html>
<div><?php if(isset($message)) { echo $message; } ?></div>
<form method="post" action="" 
Current Password:<br>
<input type="password" name="currentPassword"><span id="currentPass" class="required"></span>
<br>
New Password:<br>
<input type="password" name="newPassword"><span id="newPass" class="required"></span>
<br>
Confirm Password:<br>
<input type="password" name="confirmPassword"><span id="confirmPass" class="required"></span>
<br><br>
<input type="submit" value ="Change Password">
</form>
<br>
<br>
</html>

标签： phpdatabasepasswords

解决方案

您需要使用准备好的语句，因为您目前容易受到 SQL 注入的影响。

您应该做的另一件事（出于安全目的）是在将密码放入数据库之前对其进行哈希处理。不要将诸如密码之类的内容作为纯文本放入数据库中。

password_hash($passwordEntered, PASSWORD_BCRYPT);

如果您愿意，还可以为密码散列添加额外的选项。

每当用户登录时，您都可以使用password_verify检查用户输入的密码是否与数据库中的哈希值匹配。

password_verify($passwordEntered, $hashFromDatabase);

这应该有效。我在这段代码片段中使用了准备好的语句，但没有对密码进行哈希处理。您需要用它替换 session_start() 下的所有 PHP。

// create new mysqli connection
$con = new mysqli('localhost', 'username', 'password', 'robinsnest');

// check if the sql credentials are valid
if ($con->connect_errno) {
  echo "Failed to connect to MySQL: (" . $con->connect_errno . ") " . $con->connect_error;
}

// prepared statement
$stmt = $con->prepare("SELECT * FROM members WHERE user=? LIMIT 1");

// view all paramters here:
// https://www.php.net/manual/en/mysqli-stmt.bind-param.php
// i is integer
// d is float
// s is string
// b is blob
$stmt->bind_param("s", $_SESSION["$user"]);

// execute
$stmt->execute();

// get the results
$result = $stmt->get_result();

while ($row = $result->fetch_assoc()) {
  if ($_POST["currentPass"] == $row["pass"] && $_POST["newPass"] == $row["confirmPass"]) {
    $updateStmt = $con->prepare("UPDATE members SET pass=? WHERE user=?");$stmt->bind_param("s", $_SESSION["$user"]);
    $updateStmt->bind_param("ss", $_POST["newPass"], $_SESSION["$user"]);
    $updateStmt->execute();
    $message = "Password changed successfully!";
  } else {
    $message = "Password is incorrect.";
  }
}

推荐阅读