PHP登录问题

Question

我创建其链接到数据库的登录，输入信息时登录然后运行一个空白页，什么也不做，下面是我的代码：

include "conn.php"; 
    session_start(); 

    $email_address = $_POST['email_address']; 
    $password = $_POST['password']; 

    if ($email_address && $password) 
    { 
    $connect = mysql_connect("computing","i7906890","password") or die ("couldn't connect!"); 
    mysql_select_db("i7906890") or die ("couldn't find database"); 
$guery = mysql_query("SELECT * FROM UserAccount WHERE email_address = '$email_address'"); 

if ($numrows!=0) { 
    //code to login 
    while ($row = mysql_fetch_assoc($query)) //Password Check 
    { 
     $dbemail_address = $row['email_address'] 
     $dbpassword = $row['password'] 
    } 
    //Check if they match 
    if ($email_address==$dbemail_address&&$password==$dbpassword) 
    { 
     echo "You're in! <a href='user_page.php'>click</a> here to enter the members page"; 
     $_SESSION['user']==$dbemail_address; 
    } 
    else 
     echo "Incorrect Password!"; 
} 
else 
    die("That user doesn't exist!"); 
} 
else 
    die("Please enter an email address and password!"); 
?> 

而且，这里是我的形式

<form action = "login2.php" method ="POST"> 
     <p><img src="images/space.gif" width="70px" height="1px"/><strong>Log in</strong> or <a href="register_form.php"><strong>Register</strong></a><br> 
      Email:<img src="images/space.gif" width="34px" height="1px"/><input type="text" name="user" size="33"> <br> 
      Password:<img src="images/space.gif" width="10px" height="1px"/><input type="password" name="password" size="33"> <br> 
     <div align="center"> 
     <input type="submit" value="Log in" class="button"> 
     </div> 
    </p> 
    </form> 

请帮忙！ SOS

Answer 1

你错过了几个;在你的代码，这是导致脚本废话，不显示任何东西。 （具体表现在while循环，但检查其他地方也是如此。）

编辑：您可能还需要考虑丢失该while环路一起，把密码标准的SQL语句中有更好的表现。和其他海报一样，注意SQL注入。

Answer 2

Please help! SOS是的，你在深SH ......但不是你所期望...

即使你的代码运行良好，你是谁，问大致相同的第五或第六问题，使用过时的mysql_功能在PHP登录表单与SQL injection千疮百孔......

而且也$guery是不一样的$query ...检查为q的d 摹信...

这条线：

$guery = mysql_query("SELECT * FROM UserAccount WHERE email_address = '$email_address'"); 

应至少

$query = mysql_query("SELECT * FROM UserAccount WHERE email_address = '".mysql_real_escape($email_address)."'"); 

双方是正确的，并避免注射...

但你应真的使用通过PDO准备好的声明，如下所示：

try { 
    //open connection, this is different than in the old functions 
    $dbh = new PDO('mysql:host=localhost;dbname=test', $user, $pass); 

    //***running query 
    //**step1: create statement 
    $stmt = $dbh->prepare('SELECT * FROM UserAccount WHERE email_address = :email'); //notice parameter prefixed with ':' 

    //**step2: bind values (be sure to also check out the bindParameter() function too!) 
    $stmt->bindValue(':email', $email_address); 

    //**step3: exexcute statement 
    $stmt->execute(); 

    //**step4: process results 
    $result = $stmt->fetch(PDO::FETCH_OBJ); 

    if($result->PASSWORD==$password) { 
     //logged in, do whatever reuqired 
    } 

    $dbh = null; //don't let it slip out of our hands 
} catch (PDOException $e) { 
    print "Error!: " . $e->getMessage() . "<br/>"; 
    die(); 
} 

另外，谨慎的另一个词：不要存储明文密码。即使存储MD5哈希值现在已超出范围，并且SHA1也被声明为弱...