如何检查用户和密码身份验证

Question

我正在使用angularJS和PHP在后端的应用程序，我想在我的应用程序中实现身份验证，并且我尝试了下面粘贴的代码，但它不会生成任何错误，任何消息，当我尝试输入用户名和密码时，无论用户输入什么内容，都会转到view'admin，这意味着它不检查用户和密码。在'client'表的数据库中，我有： NomClient和MDP（密码）。

的login.html

<ion-content class="padding" ng-controller="loginCtrl"> 
<div class="list list-inset" > 
<label class="item item-input"> 
     <input type="text" placeholder="nom" required="" ng-model="NomClient"> 
</label> 
<label class="item item-input"> 
     <input type="password" placeholder="Password" ng-model="mdp"> 
</label> 
    <button class="button button-block button-positive" ng-click="submit()">Login</button>  
</ion-content> 

app.js

app.controller('loginCtrl', function($scope,$state,$http){ 
    $scope.submit= function(){ 
const url = 'http://localhost/deb/login.php'; 
const postBody = { 
    NomClient: $scope.NomClient, 
    mdp: $scope.mdp 
}; 

$http.post(url, postBody).then(data => { 
    $location.path('/admin'); 
}); 
}; 

的login.php提前

<?php 

$data = json_decode(file_get_contents("php://input")); 

$connect = mysqli_connect("localhost", "root", "", "tem"); 


$response['status'] = 0; 
$response['message'] = ''; 
$NomClient=mysqli_real_escape_string($connect, $data->NomClient); 
$mdp=mysqli_real_escape_string($connect, $data->mdp); 


$query = 'SELECT * FROM `client` WHERE NomClient = "'.$NomClient.'" AND mdp= "'.$mdp.'"'; 


if(mysqli_connect_errno()){ 
    $response['status'] = 0; 
    $response['message'] = "Failed to connect to MySQL: ".mysqli_connect_error(); 
    echo jsone_encode($response);exit; 
} 

$result = mysqli_query($connect, $query); 
$rowcount=mysqli_num_rows($result); 
if($rowcount>0){ 
    $response['status'] = 1; 
    $response['message'] = 'Login successful'; 
} 
else{ 
    $response['status'] = 0; 
    $response['message'] = 'Invalid username of password'; 
} 

echo json_encode($response);exit; 
?> 

感谢

Answer 1

确定。这里有许多问题。首先，您应该使用准备好的语句进行查询。

$stmt = mysqli_prepare($link,"SELECT * FROM client WHERE NomClient = ? AND mdp=?;"); 
mysqli_stmt_bind_param($stmt,'ss', $NomClient, $mdp); 
mysqli_stmt_execute($stmt); 
mysqli_stmt_store_result($stmt); 
$rowcount = mysqli_stmt_num_rows($stmt) 
mysqli_stmt_free_result($stmt); 
mysqli_stmt_close($stmt); 

更大的问题是您存储的密码是明文，这是一种可怕的，可怕的密码管理方式。请查看password_hash（）和password_verify（）。