用户登录脚本:用户可以使用任何用户名和密码登录

Question

我正在尝试建立一个简单的用户登录系统.但是,我拥有会话和工作的所有东西,但用户登录不使用数据库.我可以输入任何用户名和密码并登录.

这是我的登录页面:

<?php
session_start();


$db_host = "localhost";             // Place the database host here
$db_username = "data_user";  // Place the username for the MySQL database here
$db_pass = "password";          // Place the password for the MySQL  database here
$db_name = "database_name";     // Place the name for the MySQL database here

if (isset($_POST['username']))
{
// MySQL Connection
$db_link = mysql_connect("$db_host","$db_username","$db_pass") or die ("could not connect to mysql. Make sure you have correctly inputed your host, username, and password.");
mysql_select_db("$db_name") or die ("no database could be found.");

$username = mysql_real_escape_string($_POST['username']);
$password = mysql_real_escape_string($_POST['password']);

// MySQL Query
$result = mysql_query("SELECT * FROM users WHERE
username = '$username' AND password = '$password' ");

if(!$result) {
    $_SESSION['error'] = '<span style="color:red">Login Failed</span>';
} else 
    {
    $row = mysql_fetch_assoc($result);
        $_SESSION['userid'] = $row['id'];
        $_SESSION['username'] = $username;
    }
    mysql_close($db_link);
}
header('Location: ./')
?>

我正在使用Bootstraps登录.所以这是我的登录html:

                <div id="login" class="modal hide fade" tabindex="-1" role="dialog" aria-labelledby="myModalLabel" aria-hidden="true">
  <div class="modal-header">
   <button type="button" class="close" data-dismiss="modal" aria-hidden="true">×</button>
    <h3 id="myModalLabel">Login</h3>
  </div>
  <div class="modal-body">

    <form class="form-horizontal" action="login.php" method="post">
  <div class="control-group">
    <label class="control-label" for="inputUsername">Username</label>
    <div class="controls">
      <input name="username" type="text" id="inputUsername" placeholder="Username">
    </div>
  </div>
  <div class="control-group">
    <label class="control-label" for="inputPassword">Password</label>
    <div class="controls">
      <input name="password" type="password" id="inputPassword" placeholder="Password">
    </div>
  </div>
  <div class="control-group">
    <div class="controls">
      <label class="checkbox">
        <input type="checkbox"> Remember me
      </label>
    </div>
  </div>
  </div>
   <div class="modal-footer">
    <button type="submit" class="btn btn-primary">Sign in</button>
    </form>
  </div>
</div>

这是使用bootstrap的非常基本的登录.我的登出工作正常,所以这很好,但无论如何,任何人都可以向我解释为什么它没有连接到数据库,你可以使用任何你能想象的用户名和密码登录？

Answer 1

if(!$result) {

是一个错误的检查.即使没有行,这也将返回有效.如果查询未能执行,则只会导致错误.您应该检查行计数,可能使用mysql_num_rows.

$num_rows = mysql_num_rows($result);
if($num_rows!=1)
{
echo "Bad U/P";
}

注意:你停止使用mysql_*函数并转移到mysqli或PDO的时间