PHP mySQL 检查用户名和密码是否在数据库中
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/26222549/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
PHP mySQL check if username and password are in the database
提问by user3763686
I want my code to check if the username and password exist in my database. It does work hardcoded, but I want to do it with a database.Right now this is what I have:
我希望我的代码检查我的数据库中是否存在用户名和密码。它确实可以硬编码，但我想用数据库来做。现在这就是我所拥有的：
if(isset($_POST["name"], $_POST["password"]))
{
$name = $_POST["name"];
$password = $_POST["password"];
$result1 = mysql_query("SELECT password FROM Users WHERE username = '".$name."'");
$result2 = mysql_query("SELECT username FROM Users WHERE password = '".$password."'");
if($name == $result2 && $password == $result1)
{
$_SESSION["logged_in"] = true;
$_SESSION["naam"] = $name;
}
else
{
echo'The username or password are incorrect!';
}
}
The problem is in the result1/2part I think, cause when I use the right username and password in my site it gives the incorrect message.
问题出在result1/2我认为的部分，因为当我在我的站点中使用正确的用户名和密码时，它给出了不正确的消息。
Oh yes and the query works too, tried it in PHPmyAdmin but then without the $namepart which I replaced it with the username
哦，是的，查询也有效，在 PHPmyAdmin 中尝试过，但没有$name用用户名替换它的部分
回答by Funk Forty Niner
You can use mysql_num_rows()and combine your query - See footnotes
您可以使用mysql_num_rows()和组合您的查询 -请参阅脚注
if(isset($_POST["name"], $_POST["password"]))
{
$name = $_POST["name"];
$password = $_POST["password"];
$result1 = mysql_query("SELECT username, password FROM Users WHERE username = '".$name."' AND password = '".$password."'");
if(mysql_num_rows($result1) > 0 )
{
$_SESSION["logged_in"] = true;
$_SESSION["naam"] = $name;
}
else
{
echo 'The username or password are incorrect!';
}
}
In order to make your present code a bit more secure, use:
为了使您当前的代码更安全，请使用：
$name = stripslashes($_POST["name"]);
$name = mysql_real_escape_string($_POST["name"]);
$password = stripslashes$_POST["password"]);
$password = mysql_real_escape_string($_POST["password"]);
but do look at the links below about using prepared statements and password hashing.
但请查看下面有关使用准备好的语句和密码散列的链接。
Footnotes:
脚注：
Your present code is open to SQL injection. Use prepared statements, or PDO with prepared statements. Visit those links for more information.
您当前的代码对SQL 注入是开放的。使用准备好的语句，或带有准备好的语句的 PDO。访问这些链接了解更多信息。
I noticed you may be storing passwords in plain text. If this is the case, it is highly discouraged.
我注意到您可能以纯文本形式存储密码。如果是这种情况，这是非常不鼓励的。
If you are and this is a LIVE site, you will eventually get hacked.
如果您是并且这是一个实时站点，那么您最终会被黑客入侵。
I recommed you use CRYPT_BLOWFISHor PHP 5.5's password_hash()function. For PHP < 5.5 use the password_hash() compatibility pack.
我建议您使用CRYPT_BLOWFISH或 PHP 5.5 的password_hash()函数。对于 PHP < 5.5，请使用password_hash() compatibility pack.
mysql_*functions deprecation notice:
mysql_*功能弃用通知：
http://www.php.net/manual/en/intro.mysql.php
http://www.php.net/manual/en/intro.mysql.php
This extension is deprecated as of PHP 5.5.0, and is not recommended for writing new code as it will be removed in the future. Instead, either the mysqlior PDO_MySQLextension should be used. See also the MySQL API Overviewfor further help while choosing a MySQL API.
自 PHP 5.5.0 起，此扩展已弃用，不推荐用于编写新代码，因为将来会删除它。相反，应该使用mysqli或PDO_MySQL扩展。在选择 MySQL API 时，另请参阅MySQL API 概述以获取进一步帮助。
These functions allow you to access MySQL database servers. More information about MySQL can be found at ? http://www.mysql.com/.
这些函数允许您访问 MySQL 数据库服务器。有关 MySQL 的更多信息可以在 ? http://www.mysql.com/。
Documentation for MySQL can be found at ? http://dev.mysql.com/doc/.
MySQL 的文档可以在 ? http://dev.mysql.com/doc/。
Edit:to help out OP (do look into the links I've provided concerning password hashing).
编辑：帮助 OP（请查看我提供的有关密码散列的链接）。
Try replacing
尝试更换
if(mysql_num_rows($result1) > 0 )
{
$_SESSION["logged_in"] = true;
$_SESSION["naam"] = $name;
}
else
{
echo 'The username or password are incorrect!';
}
with:
和：
while($row=mysql_fetch_assoc($result1))
{
$check_username=$row['username'];
$check_password=$row['password'];
}
if($username == $check_username && $password == $check_password){
echo "Matches.";
}
else{
echo "No match found.";
}
回答by random123
Try this: (i have used mysql object oriented,if you want you can use other version)
试试这个：（我用过 mysql 面向对象，如果你想你可以使用其他版本）
if(isset($_POST["name"], $_POST["password"])) {
if(isset($_POST["name"], $_POST["password"])) {
$name = $_POST["name"];
$password = $_POST["password"];
$select1 = "SELECT password FROM USERS WHERE username = '".$name."'";
$result1=$conn->query($select1);
$row1=$result1->fetch_assoc();
$select2 = "SELECT username FROM USERS WHERE password = '".$password."'";
$result2=$conn->query($select2);
$row2=$result2->fetch_assoc();
if($name == $row2["username"] && $password == $row1["password"])
{
$_SESSION["logged_in"] = true;
$_SESSION["naam"] = $name;
}
else
{
echo'The username or password are incorrect!';
}
回答by Paari Dhanush
error_reporting(E_ALL);
ini_set('display_errors', 1);
session_start();
if(count($_POST)>0)
{
include'includePhp.php';
$sql="SELECT * FROM admin WHERE username='" . $_POST['username'] . "' AND password = '". $_POST['password']."'";
$result = $con->query($sql);
if ($result->num_rows > 0)
{
while($row = $result->fetch_assoc())
{
if(!empty($row) && !empty($row['username']) AND !empty($row['password']))
{
$_SESSION['username'] = $row['username'];
echo "SUCCESSFULLY LOGIN ";
header("Location: inDhanush.php");
}
else
{
echo "Try again";
}
}
}
}
}
回答by helllomatt
The $nameand $passwordare probably strings. If your queries are going through and completing properly, they will be returned as objects.
的$name和$password可能是字符串。如果您的查询正在通过并正确完成，它们将作为对象返回。
In order for that to work, you just have to remove $name ==and $password ==from the if()conditional!
为了让它起作用，你只需要从条件中删除$name ==和！$password ==if()
You can also combine those queries for simplicity.
为了简单起见，您还可以组合这些查询。
<?php
$result = mysql_query("SELECT username, password FROM Users WHERE username = '".$name."' && password = '".$password."'");
if ($result && mysql_num_rows($result) > 0) {
// Login
} else {
// Failed!
}
That will accomplish the same thing, if you don't care about knowing which one failed.
如果您不关心知道哪个失败了，那将完成同样的事情。
