因此，此實作與 md5 密碼檢查一起作業，但在實施密碼哈希檢查（為了在我的資料庫中更安全的密碼存盤）后，不允許成員登錄。輸入正確的電子郵件和密碼后，用戶只會被帶回index.php 頁面。任何幫助，將不勝感激。這是我的 session.php 代碼：
<?php
session_start();
//Check whether the session variable SESS_MEMBER_ID is present or not
// do check
if(!isset($_SERVER['HTTP_REFERER'])){
// redirect them to your desired location
header('Location: custom_404.html');
exit;
}
if (!isset($_SESSION['alogin']) || (trim($_SESSION['alogin']) == '')) { ?>
<!-- send to home page -->
<script>
window.location = "../index.php";
</script>
<?php
}
$session_id=$_SESSION['alogin'];
$session_depart = $_SESSION['arole'];
?>這是應該在 index.php 中作業的內容：
<?php
session_start();
include('includes/config.php');
if(isset($_POST['signin']))
{
$username=$_POST['username'];
$username=strtolower($username);
$password=$_POST['password'];
$sql ="SELECT * FROM tblemployees where EmailId = '$username'";
$query= mysqli_query($conn, $sql);
$count = mysqli_num_rows($query);
if($count>0)
{
$passwordCheck = mysqli_fetch_assoc($query)['Password'];
if(!password_verify($password,$passwordCheck)){
echo "<script>alert('Wrong password please try again.');</script>";
}
while ($row = mysqli_fetch_assoc($query)) {
if ($row['role'] == 'Admin') {
$_SESSION['alogin']=$row['emp_id'];
$_SESSION['arole']=$row['Department'];
echo "<script type='text/javascript'> document.location = 'admin/admin_dashboard.php'; </script>";
}
elseif ($row['role'] == 'Staff') {
$_SESSION['alogin']=$row['emp_id'];
$_SESSION['arole']=$row['Department'];
echo "<script type='text/javascript'> document.location = 'staff/index.php'; </script>";
}
else {
$_SESSION['alogin']=$row['emp_id'];
$_SESSION['arole']=$row['Department'];
echo "<script type='text/javascript'> document.location = 'heads/index.php'; </script>";
}
}
}
else{
echo "<script>alert('Wrong email or password please try again.');</script>";
}
}
// $_SESSION['alogin']=$_POST['username'];
// echo "<script type='text/javascript'> document.location = 'changepassword.php'; </script>";
?>uj5u.com熱心網友回復：
您的登錄代碼有誤。回圈
while ($row = mysqli_fetch_assoc($query))
永遠不會獲取任何東西，因為您已經閱讀了該行
$passwordCheck = mysqli_fetch_assoc($query)['Password'];
您應該只獲取該行一次，并將其用于密碼和角色檢查。
您還應該使用準備好的陳述句來防止 SQL 注入。
<?php
session_start();
include('includes/config.php');
if(isset($_POST['signin']))
{
$username=$_POST['username'];
$username=strtolower($username);
$password=$_POST['password'];
$sql ="SELECT * FROM tblemployees where EmailId = ?";
$stmt= mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "s", $username);
mysqli_stmt_execute($stmt);
$query = mysqli_stmt_get_result($stmt);
$row = mysqli_fetch_assoc($query);
if($row)
{
$passwordCheck = $row['Password'];
if(!password_verify($password,$passwordCheck)){
echo "<script>alert('Wrong email or password please try again.');</script>";
} else {
if ($row['role'] == 'Admin') {
$_SESSION['alogin']=$row['emp_id'];
$_SESSION['arole']=$row['Department'];
echo "<script type='text/javascript'> document.location = 'admin/admin_dashboard.php'; </script>";
}
elseif ($row['role'] == 'Staff') {
$_SESSION['alogin']=$row['emp_id'];
$_SESSION['arole']=$row['Department'];
echo "<script type='text/javascript'> document.location = 'staff/index.php'; </script>";
}
else {
$_SESSION['alogin']=$row['emp_id'];
$_SESSION['arole']=$row['Department'];
echo "<script type='text/javascript'> document.location = 'heads/index.php'; </script>";
}
}
}
else{
echo "<script>alert('Wrong email or password please try again.');</script>";
}
}
// $_SESSION['alogin']=$_POST['username'];
// echo "<script type='text/javascript'> document.location = 'changepassword.php'; </script>";
?>
轉載請註明出處，本文鏈接：https://www.uj5u.com/ruanti/395699.html
標籤：javascript php 验证 会议