PHP会话登录问题 [英] php session login issue

问题描述

 <？php 
 session_start（）; 
 
 
 $ username = $ _POST ['username']; 
 $ password = $ _POST ['password']; 
 
包含'includes / connect.php'; 
 
 $ username = mysqli_real_escape_string（$ con，$ username）; 
 $ query =SELECT password，salt 
 FROM member 
 WHERE username ='$ username';;; 
 
 $ result = mysqli_query（$ con，$ query）; 
 
 if（mysqli_num_rows（$ result）== 0）
 {
 header（'Location：login.html'）; 
} 
 
 $ userData = mysqli_fetch_array（$ result，MYSQL_ASSOC）; 
 $ hash = hash（'sha256'，$ userData ['salt'] .hash（'sha256'，$ password））; 
 
 $ _SESSION ['username'] = $ username; 
 $ b $ if（$ hash！= $ userData ['password']）
 {
 header（'Location：login.html'）; 
} else {//成功登录后重定向到主页。 
 $ _SESSION ['username'] = $ username; 
 header（'Location：stats.php'）; 
} 
？> 
  

然后这是stats.php：

 <？php 
 session_start（）; 
 if（！isset（$ _ SESSION ['username']））{
 header（Location：register.html）; 
} 
？> 
  

以及这是我的html 5文档。

然而，如果im登录或不，它仍然允许我访问stats.php

解决方案

您是不存储任何会话值，所以如果条件将永远失败。

因此添加

  $ _ SESSION ['username'] = $ userData ['username']; 
  

里面 login.php。

I have a this login script:

<?php
session_start();


$username = $_POST['username'];
$password = $_POST['password'];

include 'includes/connect.php';

$username = mysqli_real_escape_string($con, $username);
$query = "SELECT password, salt
    FROM member
    WHERE username = '$username';";

$result = mysqli_query($con, $query);

if(mysqli_num_rows($result) == 0) 
{
header('Location: login.html');
}

$userData = mysqli_fetch_array($result, MYSQL_ASSOC);
$hash = hash('sha256', $userData['salt'] . hash('sha256', $password) );

$_SESSION['username']=$username; 

if($hash != $userData['password']) 
{
header('Location: login.html');
}else{ // Redirect to home page after successful login.
 $_SESSION['username']=$username; 
header('Location: stats.php');
}
?>

then this is stats.php:

 <?php 
 session_start();
 if(!isset($_SESSION['username'])){
 header("Location:register.html");
 }
 ?>

and under this is my html 5 document.

however it doesnt matter if im logged in or not and it still allows me to access stats.php

解决方案

You are not storing any session value so if condition will always fail.

So Add

$_SESSION['username'] = $userData['username'];

inside login.php.

这篇关于PHP会话登录问题的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！