2 回答

TA貢獻(xiàn)1875條經(jīng)驗(yàn) 獲得超3個(gè)贊
在數(shù)據(jù)庫中找到您的用戶后,您沒有設(shè)置 $_SESSION['username'] 。
我不是 PHP 專家,但我認(rèn)為您需要執(zhí)行類似 $_SESSION['username'] = 'xyz' 的操作。除此之外,您的選擇查詢很容易受到 sql 注入的影響。

TA貢獻(xiàn)1869條經(jīng)驗(yàn) 獲得超4個(gè)贊
在你的腳本中有一個(gè)錯(cuò)誤
$sql="SELECT * FROM loginform where korisnickoime='".$username."'AND sifrajedan='".$password."' limit 1";
在用戶名附近的查詢中,和where korisnickoime='".$username."'AND sifrajedan='".$password."'
之間沒有空格 。$username
AND
附加用戶名和密碼后此查詢的最終結(jié)果將類似于
SELECT * FROM loginform where korisnickoime='user1'AND sifrajedan='xyz' limit 1";
此查詢將中斷,因此請(qǐng)?jiān)趦烧咧g添加一點(diǎn)空格,用此替換您的查詢字符串。
$sql="SELECT * FROM loginform where korisnickoime='".$username."' AND sifrajedan='".$password."' limit 1";
你的 PHP 腳本可能是這樣的
索引.php
<form method="post" name="login">
<label for="username">Username:</label><br>
<input type="text" name="username"><br>
<label for="password">Password:</label><br>
<input type="password" name="password"><br>
<button type="submit" name="login">Log in</button>
</form>
<?php
session_start();
if(isset($_POST['username']) and isset($_POST['password']))
{
$username = $_POST['username'];
$pass = $_POST['password'];
$query = "SELECT * FROM `person` WHERE name='$username' and pass='$pass'";
$result = mysql_query($query) or die(mysql_error());
$count = mysql_num_rows($result);
if ($count == 1){
$_SESSION['username'] = $username;
header('Location: homepage.php');
}
else
{
$msg = "Wrong credentials";
}
}
if(isset($msg) & !empty($msg)){
echo $msg;
}
?>
然后在 homepage.php
<nav>
<ul class="nav__links">
<li><a href="#">Services</a></li>
<li><a href="#">Projects</a></li>
<li><a href="#">About</a></li>
<li><a href="#">
<span>
<?php
session_start();
if(!isset($_SESSION['username']))
{
die("You are not logged in!");
}
$username = $_SESSION['username'];
echo "Hai " . $username;
?>
</span></a></li>
</ul>
</nav>
PS:為了使您的查詢安全使用這樣的參數(shù)化查詢
<?php
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "myDB";
// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
$stmt = $conn->prepare(SELECT * FROM loginform where korisnickoime='?' AND sifrajedan='?' limit 1");
$stmt->bind_param("ss", $username, $password);
// set parameters and execute
$username = "John";
$password = "Doe";
$result = $stmt->execute();
?>
- 2 回答
- 0 關(guān)注
- 206 瀏覽
添加回答
舉報(bào)