0
我有一个用php和mysql编写的登录表单代码（和一个数据库打印代码），由六部分组成：dbmanager.php，login.php，index.php，login_process.php，home.php和user.php。保护PHP网页访问
登录过程正常，当有人输入有效的用户名和密码时，该用户被重定向到home.php。而且，如果有人输入了无效的用户名或密码，该用户将被重定向到login_process.php，表明它是无效的用户名或密码，这很好。
问题是，如果任何人直接进入home.php，那么这个人是正确的身份验证，而无需输入任何用户名或密码。
你可以请我们指导我为了确保home.php只为数据库中的用户？
在此先感谢！我非常感谢你的帮助！
我的数据库由四列组成：用户名，密码，姓氏和名字。
这是我的代码：
dbmanager.php
<?php
class DBManager{
function getConnection(){
$services = getenv("VCAP_SERVICES");
$services_json = json_decode($services,true);
$mysql_config = $services_json["mysql-5.5"][0]["credentials"];
$db = $mysql_config["name"];
$host = $mysql_config["host"];
$port = $mysql_config["port"];
$username = $mysql_config["user"];
$password = $mysql_config["password"];
$conn = mysql_connect($host . ':' . $port, $username, $password);
if(! $conn){
die('Could not connect: ' . mysql_error());
}
mysql_select_db($db);
return $conn;
}
}
?>
的index.php
<?php
require 'user.php';
?>
<html>
<head>
<title>DB Query PHP Page</title>
</head>
<body>
<p>SAMPLE PHP SITE</p>
<p>Contents of table User:</p>
<table border='1'>
<tr>
<td>Username</td>
<td>Password</td>
<td>Last Name</td>
<td>First Name</td>
</tr>
<?php
//refer to user.php for the implementation of the class User
$user_list = (new User())->selectAll();
foreach($user_list as $user) {
echo '<tr>';
echo '<td>'.$user->username.'</td>';
echo '<td>'.$user->password.'</td>';
echo '<td>'.$user->lastname.'</td>';
echo '<td>'.$user->firstname.'</td>';
echo '</tr>';
}
?>
</table>
<br><br>
Click <a href='login.php'>[here]</a> to test the login page.<br>
</body>
</html>
的login.php
<html>
<head>
<title>Login Page</title>
</head>
<body>
<p>SAMPLE PHP SITE</p>
<p>Enter Username and Password to Login:</p>
<form action='login_process.php' method='post'>
<table border='1'>
<tr>
<td>Username:</td>
<td><input type='text' name='username'></td>
</tr>
<tr>
<td>Password:</td>
<td><input type='password' name='password'></td>
</tr>
<tr>
<td> </td>
<td><input type='submit' value='Login'></td>
</tr>
</table>
</form>
</body>
</html>
login_process.php
<?php
require 'user.php';
?>
<?php
$user = new User();
$user->username = $_REQUEST['username'];
$user->password = $_REQUEST['password'];
$found = $user->checkLogin();
if ($found){//redirect to home page
session_start();
$_SESSION['current_user']=$user;
header("Location: home.php");
exit;
}else{//invalid username and password
echo "Invalid username/password. Click <a href='login.php'>[here]</a> to login again.<br>";
echo "<br>";
echo "You may also click <a href='index.php'>[here]</a> to see the list of usernames and passwords.<br>";
}
?>
home.php
<?php
require 'user.php';
?>
<html>
<head>
<title>Home Page</title>
</head>
<body>
<p>SAMPLE PHP SITE</p>
<p>
You have successfully logged in
<?php
session_start();
$user = $_SESSION['current_user'];
echo $user->firstname.' '.$user->lastname.'.';
?>
</p>
<p>This is your home page.</p>
</body>
</html>
user.php的
<?php
require 'dbmanager.php';
?>
<?php
class User{
var $username;
var $password;
var $lastname;
var $firstname;
function checkLogin(){
$dbm = new DBManager();
$conn = $dbm->getConnection();
$username = mysql_real_escape_string($this->username);
$password = mysql_real_escape_string($this->password);
$sql_stmt = "SELECT * FROM User WHERE username = '".$username."' AND password = '".$password."'";
//place in retval result of the SQL query
$retval = mysql_query($sql_stmt, $conn);
//check if SQL query is successful
if(! $retval){
mysql_close($conn);
die('Could not read User table: ' . mysql_error());
}
$found = false;
//get first retrieved row from retval
if ($dbfield = mysql_fetch_assoc($retval)) {
$found = true;
//initialize fields of this object with the columns retrieved from the query
$this->username = $dbfield['username'];
$this->password = $dbfield['password'];
$this->lastname = $dbfield['lastname'];
$this->firstname = $dbfield['firstname'];
}
return $found;
}
function selectAll(){
$dbm = new DBManager();
$conn = $dbm->getConnection();
$sql_stmt = "SELECT * FROM User";
//place in retval result of the SQL query
$retval = mysql_query($sql_stmt, $conn);
//check if SQL query is successful
if(! $retval){
mysql_close($conn);
die('Could not read User table: ' . mysql_error());
}
//create an empty array that will eventually contain the list of users
$user_list=array();
//iterate each row in retval
while ($dbfield = mysql_fetch_assoc($retval)) {
//instantiate a user object
$user = new User();
//initialize fields of user object with the columns retrieved from the query
$user->username = $dbfield['username'];
$user->password = $dbfield['password'];
$user->lastname = $dbfield['lastname'];
$user->firstname = $dbfield['firstname'];
//add the user object in the array
$user_list[] = $user;
}
mysql_close($conn);
//return the array
return $user_list;
}
}
?>
使用'$ _SESSION'阵列的状态，以测试用户是否已经正确地或者没有登录。 – Scuzzy