php - 我和一些用户无法登录我的 Web 应用程序，我该如何解决？

Question

美好的一天房子。这是我第二次被锁定在我正在开发的 Web 应用程序之外。它仍在使用 PHP 和 MySQL 在我的本地主机（笔记本电脑）上开发。请问这可能是什么原因造成的？我已经在这个项目上工作了几个月，但现在在 2 周内就被锁定了。没有新的插件或第三方的东西。究竟是什么原因造成的？唯一改变的是我的 PHP 版本（以前的和现在的仍然是 PHP7，只是一个小升级）。我应该注意什么？

我很少有其他用户可以登录，也很少有人不喜欢我，所以问题不在于登录代码。我一直在登录和退出，然后突然无缘无故地被拒之门外，而其他人仍然可以登录。我猜这不是代码问题。

这是我的登录代码

require_once '../classes/DbManager.php';

$error = array();

if (isset($_POST['action']) && $_POST['action'] == 'login') 
{
   //Validate/Sanitize the user input
   $username = filter_var($_POST['username'], FILTER_SANITIZE_STRING);
   $password = filter_var($_POST['password'], FILTER_SANITIZE_STRING);
   
   if(empty($username))
   {
       $error[] = 'The username field cannot be left empty';
   }
   
   if(empty($password))
   {
       $error[] = 'The password field cannot be left empty';
   }
   
   if(empty($error))
   {
      // start the session
      session_start(); 
      
        // connect to the database
        $conn = DbManager::getConnection();
        //Get the hash from the database
        try{
        $sql = "SELECT hash FROM users WHERE username = :username";

        $st = $conn->prepare($sql);
        // bind variables when executing statement
        $st->bindValue(':username', $username);
        $st->execute();
        }
        catch (PDOException $e)
        {
        $error[] = 'Invalid username or password.';
        }
        // if a match is found, rowCount() produces 1, which is treated as true
        
       if($st->rowCount() == 1) 
        { 
            $row = $st->fetch();
            $hash = $row['hash'];
        }
        
        // connect to the database
        $conn = DbManager::getConnection();
        //Now connect to log the user in
        try{
        $sql = "SELECT username FROM users WHERE username = :username AND password = AES_ENCRYPT(:password, :hash)";

        $stmt = $conn->prepare($sql);
        // bind variables when executing statement
        $stmt->bindValue(':username', $username);
        $stmt->bindValue(':password', $password);
        $stmt->bindValue(':hash', $hash);
        $stmt->execute();
        }
        catch (PDOException $e)
        {
        $error[] = 'Invalid username or password.';
        }
        // if a match is found, rowCount() produces 1, which is treated as true
        
        
       if($stmt->rowCount() == 1) 
        { 
            $row = $stmt->fetch();
            $username = $row['username'];
           
        $_SESSION['loggedIn'] = TRUE;
        $_SESSION['username'] = $username;
        
        session_regenerate_id(true);
        }

        // if no match, destroy the session and prepare error message
        else {
        $_SESSION = array();
        session_destroy();
        $error[] = 'Invalid username or password.';
        }
        
        
        // if the session variable has been set, redirect
        if (isset($_SESSION['loggedIn'])) {
        // get the time the session started
        $_SESSION['start'] = time();

        $login = TRUE;

        header('Location: ../my-account/');
        exit();
        }
        else
        {
    header('Location: .');
    }
   }
   
}

标签： phpmysqlauthentication