PHP $_Session , JS 在成功输入用户名和密码后不允许成员登录

Question

因此，此实现使用 md5 密码检查，但在实施密码哈希检查（为了在我的数据库中更安全地存储密码）后，不允许成员登录。用户在输入正确的电子邮件和密码后仅返回 index.php 页面。任何帮助，将不胜感激。这是我的 session.php 代码：

<?php
     session_start(); 
    //Check whether the session variable SESS_MEMBER_ID is present or not
    // do check

    if(!isset($_SERVER['HTTP_REFERER'])){
        // redirect them to your desired location
        header('Location: custom_404.html');
        exit;
    }
    if (!isset($_SESSION['alogin']) || (trim($_SESSION['alogin']) == '')) { ?>
    <!-- send to home page -->
    <script>
    window.location = "../index.php";
    </script>
    <?php
    }
    $session_id=$_SESSION['alogin'];
    $session_depart = $_SESSION['arole'];
    ?>

以下是 index.php 中应该工作的内容：

    <?php
    session_start();
    include('includes/config.php');
    if(isset($_POST['signin']))
    {
        $username=$_POST['username'];
        $username=strtolower($username);
        $password=$_POST['password'];

        $sql ="SELECT * FROM tblemployees where EmailId = '$username'";
        $query= mysqli_query($conn, $sql);
        $count = mysqli_num_rows($query);

        if($count>0)
        {
            $passwordCheck = mysqli_fetch_assoc($query)['Password'];
            if(!password_verify($password,$passwordCheck)){
                echo "<script>alert('Wrong password please try again.');</script>";
            }
            while ($row = mysqli_fetch_assoc($query)) {
                if ($row['role'] == 'Admin') {
                    $_SESSION['alogin']=$row['emp_id'];
                    $_SESSION['arole']=$row['Department'];
                    echo "<script type='text/javascript'> document.location = 'admin/admin_dashboard.php'; </script>";
                }
                elseif ($row['role'] == 'Staff') {
                    $_SESSION['alogin']=$row['emp_id'];
                    $_SESSION['arole']=$row['Department'];
                    echo "<script type='text/javascript'> document.location = 'staff/index.php'; </script>";
                }
                else {
                    $_SESSION['alogin']=$row['emp_id'];
                    $_SESSION['arole']=$row['Department'];
                    echo "<script type='text/javascript'> document.location = 'heads/index.php'; </script>";
                }
            }
        } 
        else{
          
          echo "<script>alert('Wrong email or password please try again.');</script>";

        }

    }
    // $_SESSION['alogin']=$_POST['username'];
    //  echo "<script type='text/javascript'> document.location = 'changepassword.php'; </script>";
    ?>

Answer 1

您的登录码有误。循环

while ($row = mysqli_fetch_assoc($query))

永远不会获取任何内容，因为您已经使用

读取了该行

$passwordCheck = mysqli_fetch_assoc($query)['Password'];

您应该只获取该行一次，并将其用于密码和角色检查。

您还应该使用准备好的语句来防止 SQL 注入。

<?php
session_start();
include('includes/config.php');
if(isset($_POST['signin']))
{
    $username=$_POST['username'];
    $username=strtolower($username);
    $password=$_POST['password'];

    $sql ="SELECT * FROM tblemployees where EmailId = ?";
    $stmt= mysqli_prepare($conn, $sql);
    mysqli_stmt_bind_param($stmt, "s", $username);
    mysqli_stmt_execute($stmt);
    $query = mysqli_stmt_get_result($stmt);
    $row = mysqli_fetch_assoc($query);
    if($row)
    {
        $passwordCheck = $row['Password'];
        if(!password_verify($password,$passwordCheck)){
            echo "<script>alert('Wrong email or  password please try again.');</script>";
        } else {
            if ($row['role'] == 'Admin') {
                $_SESSION['alogin']=$row['emp_id'];
                $_SESSION['arole']=$row['Department'];
                echo "<script type='text/javascript'> document.location = 'admin/admin_dashboard.php'; </script>";
            }
            elseif ($row['role'] == 'Staff') {
                $_SESSION['alogin']=$row['emp_id'];
                $_SESSION['arole']=$row['Department'];
                echo "<script type='text/javascript'> document.location = 'staff/index.php'; </script>";
            }
            else {
                $_SESSION['alogin']=$row['emp_id'];
                $_SESSION['arole']=$row['Department'];
                echo "<script type='text/javascript'> document.location = 'heads/index.php'; </script>";
            }
        }
    } 
    else{
        echo "<script>alert('Wrong email or password please try again.');</script>";
    }

}
// $_SESSION['alogin']=$_POST['username'];
//  echo "<script type='text/javascript'> document.location = 'changepassword.php'; </script>";
?>

PHP $_Session , JS 在成功输入用户名和密码后不允许成员登录

PHP $_Session , JS not allowing member login after successful username and password inserted

javascript

php

authentication

session