-1

我正在一个简单的注册系统上工作，经过数小时的研究后，我仍然坚持。PHP表格只提交一行数据

如果我的数据库很清晰（我删除了表中的任何行），并且我提交表单，它会发送验证电子邮件并激活并允许我登录。

如果我尝试使用同一封电子邮件创建另一个帐户，我没有收到我应该的错误消息，告诉用户“电子邮件已被注册”。它只是把我带到一个空白页面，即使我在创建第一行之后使用新的电子邮件地址。

当我查看我的表格时，表格创建的行（第一次）具有自动识别码，这是正确的，用户名输入到行中，但密码，电子邮件和激活都声称' 0' 。

任何人都可以看到错误在我的代码中的位置？我需要代码来验证输入的电子邮件尚未使用，如果是，则显示错误消息。如果不是，它应该在信息表中创建一个新行。

我知道我需要散列密码。我只是试图在我进行安全性之前获取表格中的信息。

的index.php

<?php 

    include 'sessions.php'; 

    if(isset($_SESSION['errormessage'])){ 
     echo ($_SESSION['errormessage']); 
     unset ($_SESSION['errormessage']); 
    } 
?> 

<html> 
<head> 
    <title>Registration Form</title> 
</head> 

<body> 
    <form name="newForm" method="post" action="createaccount.php">UserName: 
    <input type="text" name="newUserName" size="15" maxlength="15"> 
    <br>Password: 
    <input type="password" name="newPass1" size="15"> 
    <br>Confirm Password: 
    <input type="password" name="newPass2" size="15"> 
    <br>Email: 
    <input type="email" name="newEmail" size="15"> 
    <br> 
      <input type="submit" name="newSubmit"> 
      <input type="reset" name="newReset"> 
     </p> 
    </form> 

<hr> 

    <form name="newForm" method="post" action="login.php"> 
     <strong>Already Registered? Login Here:</strong> 
     <br> 
    UserName: 
    <input type="text" name="UserName" size="15" maxlength="15"> 
    <br>Password: 
    <input type="password" name="Pass1" size="15"> 
    <br>   
     <input type=submit name=SubmitButton value=Submit> 
     <input type=reset name=ResetButton value=Clear> 
    </form>  

</body> 

</html>

createaccount.php

<?php 

    include ('sessions.php'); 
    include ('database_connection.php'); 

//function to test password 
function passwordStrength($pwd) { 
    //test for at least 8 characters 
    if (strlen($pwd) < 8) { 
     return false; 
    } 
    //test for max length 
    if (strlen($pwd) > 16) { 
     return false; 
    } 
    //test to see if password contains number 
    if(!preg_match("#[0-9]+#", $pwd)) { 
     return false; 
    } 
    //test to see if password has capital letter 
    if(!preg_match("#[A-Z]+#", $pwd)) { 
     return false; 
    } 
    //test to see if password has a lowercase letter 
    if(!preg_match("#[a-z]+#", $pwd)) { 
     return false; 
    } 
    //test to see if password has special character 
    if(!preg_match("#[^0-9A-Za-z]#", $pwd)) { 
     return false; 
    } 
    //test to see if password contains a space 
    if (strpos($pwd, ' ') > 0) { 
     return false; 
    } 
    else { 
     return true; 
    } 

    return true; 
} 

    if(isset($_POST['newSubmit'])){ 
      if(empty($_POST['newUserName'])) { 
      $_SESSION['errormessage'] = "Please enter a username!"; 
      header("Location: index.php"); 
      } 
      else if (strlen($_POST['newUserName']) < 4) { 
       $_SESSION['errormessage'] = "Username is too short!"; 
       header("Location: index.php"); 
      } else if(strlen($_POST['newUserName']) > 16) { 
       $_SESSION['errormessage'] = "Username is too long!"; 
       header("Location: index.php"); 
      } else if(empty($_POST['newPass1'])) { 
       $_SESSION['errormessage'] = "You must enter a password!"; 
       header("Location: index.php"); 
      } else if(empty($_POST['newPass2'])) { 
       $_SESSION['errormessage'] = "You must confirm your password!"; 
       header("Location: index.php"); 
      } else if($_POST['newPass1'] !== $_POST['newPass2']) { 
       $_SESSION['errormessage'] = "Passwords do not match!"; 
       header("Location: index.php"); 
      } else if(!passwordStrength($_POST['newPass1'])) { 
       $_SESSION['errormessage'] = "Password does not meet requirements!"; 
       header("Location: index.php"); 
      } else if(empty($_POST['newEmail'])) { 
       $_SESSION['errormessage'] = "Must enter an email address!"; 
       header("Location: index.php"); 
      } else { 
       $Email = $_POST['newEmail']; 
       $name = $_POST['newUserName']; 
       $Password = $_POST['newPass1']; 
       //echo "All fields accepted!"; 
       //$pwd = $_POST['newPass1']; 
       //echo hash("sha256", $pwd); 
       // Make sure the email address is available: 
       $query_verify_email = "SELECT * FROM userDB WHERE email ='$Email'"; 
       $result_verify_email = mysqli_query($db, $query_verify_email); 
       if (!$result_verify_email) {//if the Query Failed ,similar to if($result_verify_email==false) 
        $_SESSION['errormessage'] = "Sorry, that email address has already been registered!<br />If you already have an account, login below.<br /><br />"; 
        header("Location: index.php"); 
       } 

       if (mysqli_num_rows($result_verify_email) == 0) { // IF no previous user is using this email . 


        // Create a unique activation code: 
        $activation = md5(uniqid(rand(), true)); 


        $query_insert_user = "INSERT INTO `userDB` (`username`, `email`, `password`, `activation`) VALUES ('$name', '$Email', '$Password', '$activation')"; 


        $result_insert_user = mysqli_query($db, $query_insert_user); 
       if (!$result_insert_user) { 
        echo 'Query Failed '; 
       } 

       if (mysqli_affected_rows($db) == 1) { //If the Insert Query was successfull. 
        //send the email 
        $to = $_POST['newEmail']; // this is your Email address 
        $from = "[email protected]"; // this is the sender's Email address 
        $subject = "Account Succesfully Created"; 
        $message = "Thank you for creating an account. Please activate it now using the link below!"; 
        $message2 = "http://cts.gruv.org/short/form/activate.php?username=".$_POST['newUserName']."\n"; 
        $headers = "From:" . $from; 
        $headers2 = "From:" . $to; 
        mail($to,$subject,$message2,$message,$headers); 
        mail($from,$subject,$message2,$message,$headers); // sends a copy of the message to the sender 
         $_SESSION['errormessage'] = "A confirmation e-mail has been sent to you. Please activate your account to login."; 
         header("Location: index.php"); 
       } 
       mysqli_close($db);//Close the DB Connection 
      } 
     } 
    }

activate.php

<?php 

include 'sessions.php'; 
include 'database_connection.php'; 

if (isset($_GET['Email']) && preg_match('/^([a-zA-Z0-9])+([a-zA-Z0-9\._-])*@([a-zA-Z0-9_-])+([a-zA-Z0-9\._-]+)+$/', $_GET['Email'])) 
{ 
    $email = $_GET['Email']; 
} 
if (isset($_GET['key']) && (strlen($_GET['key']) == 32))//The Activation key will always be 32 since it is MD5 Hash 
{ 
    $key = $_GET['key']; 
} 


if (isset($Email) && isset($key)) 
{ 
    // Update the database to set the "activation" field to null 

    $query_activate_account = "UPDATE userDB SET activation=NULL WHERE(email ='$Email' AND activation='$key')LIMIT 1"; 


    $result_activate_account = mysqli_query($db, $query_activate_account) ; 

    // Print a customized message: 
    if (mysqli_affected_rows($db) == 1)//if update query was successfull 
    { 
    echo '<div class="success">Your account is now active. You may now <a href="login.php">Log in</a></div>'; 

    } else 
    { 
     echo '<div class="errormsgbox">Oops !Your account could not be activated. Please recheck the link or contact the system administrator.</div>'; 

    } 

    mysqli_close($db); 

} else { 
     echo '<div class="errormsgbox">Error Occured .</div>'; 
} 


?>

如果请求的任何详细信息，我会编辑这个职位。

来源

2015-11-08 still2blue

如果浏览器获得一个空白页面，这可能帮助：http://stackoverflow.com/questions/1475297/phps-white-screen-of-death – Mike

在'$ query_verify_email =“SELECT * FROM userDB WHERE email ='$ Email'”; $ result_verify_email = mysqli_query（$ db，$ query_verify_email）; if（！$ result_verify_email）{//如果查询失败，类似于if（$ result_verify_email == false） $ _SESSION ['errormessage'] =“抱歉，该电子邮件地址已被注册！
如果您已经有一个帐户，请登录

“; header（“Location：index.php”）; }'不应该'if（！$ result_verify_email）'是'if（$ result_verify_email）'？如果查询成功，你想执行'if'即ie。如果电子邮件是*发现* –

您的代码*广泛开放*到** SQL注入攻击**。用户几乎可以在数据库上执行任何他们想要的代码。此外，你**以*纯文本***存储用户密码。这对你的用户来说是非常不负责任的**。密码应该用单向散列来遮盖，并且永远不可以检索，甚至不能由数据库管理员检索。 – David

$query_verify_email = "SELECT * FROM userDB WHERE email ='$Email'"; 
$result_verify_email = mysqli_query($db, $query_verify_email); 
if (!$result_verify_email) {//if the Query Failed ,similar to if($result_verify_email==false) 
     $_SESSION['errormessage'] = "Sorry, that email address has already been registered!<br />If you already have an account, login below.<br /><br />"; 
     header("Location: index.php"); 
}

http://php.net/manual/en/mysqli.query.php

返回FALSE失败。 对于成功的SELECT，SHOW，DESCRIBE或 EXPLAIN查询mysqli_query（）将返回一个mysqli_result对象。对于其他成功的查询mysqli_query（）将返回TRUE。

由于您使用的是正确的SQL select语句，因此mysqli_query将返回一个mysqli_result对象。

mysqli_result中有num_rows属性，它指示找到的行数。您可以使用它来检查是否有该电子邮件的记录。
如果您希望获得1个结果，请始终使用LIMIT 1。

FIX：

$query_verify_email = "SELECT * FROM userDB WHERE email ='$Email' LIMIT 1"; 
$result_verify_email = mysqli_query($mysqli, $query_verify_email); 

if (is_object($result_verify_email) && $result_verify_email->num_rows > 0) { 
    echo "Email already exists"; 
}

来源

2015-11-08 21:21:07

PHP表格只提交一行数据

的index.php

createaccount.php

activate.php

回答

相关问题