PHP $_SESSION 变量未显示值答案

【问题标题】：PHP $_SESSION variable not showing the valuePHP $_SESSION 变量未显示值
【发布时间】：2020-09-04 03:34:33
【问题描述】：

我正在页面的标题中创建一个包含已登录用户名称的文本。它工作了一段时间，但是当我去做其他事情时，它就停止了。就像 $_SESSION['ime'] 持有一个空值；我很确定我没有碰任何与此相关的东西。

下面是一些代码：我的主 php 文件：

session_start();

// initializing variables
$username = "";
$email    = "";
$errors = array(); 

// connect to the database
$db = mysqli_connect('localhost', 'root', '', 'audiprojekat');

// REGISTER USER
if (isset($_POST['reg_user'])) {
  $vrsta = "KO";
  $ime = mysqli_real_escape_string($db, $_POST['ime']);
  $prezime = mysqli_real_escape_string($db, $_POST['prezime']);
  $username = mysqli_real_escape_string($db, $_POST['username']);
  $email = mysqli_real_escape_string($db, $_POST['email']);
  $password = mysqli_real_escape_string($db, $_POST['password']);



  // first check the database to make sure 
  // a user does not already exist with the same username and/or email
  $user_check_query = "SELECT * FROM registrovani WHERE username='$username' OR email='$email' LIMIT 1";
  $result = mysqli_query($db, $user_check_query);
  $user = mysqli_fetch_assoc($result);

  if ($user) { // if user exists
    if ($user['username'] === $username) {
      array_push($errors, "Username already exists");
    }

    if ($user['email'] === $email) {
      array_push($errors, "email already exists");
    }
  }

  // Finally, register user if there are no errors in the form
  if (count($errors) == 0) {
    $password = md5($password);//encrypt the password before saving in the database

    $query = "INSERT INTO registrovani (ime, prezime, username, email, password, vrsta) 
              VALUES('$ime','$prezime','$username', '$email', '$password', '$vrsta')";
    mysqli_query($db, $query);
    $_SESSION['username'] = $username;
    $_SESSION['ime'] = $ime;
    $_SESSION['success'] = "You are now logged in";
    header('location: user.php');
  }
}

if (isset($_POST['login_user'])) {
  $username = mysqli_real_escape_string($db, $_POST['username']);
  $password = mysqli_real_escape_string($db, $_POST['password']);

  if (empty($username)) {
    array_push($errors, "Username is required");
  }
  if (empty($password)) {
    array_push($errors, "Password is required");
  }

  if (count($errors) == 0) {
    $password = md5($password);
    $query = "SELECT * FROM registrovani WHERE username='$username' AND password='$password'";
    $results = mysqli_query($db, $query);
    if (mysqli_num_rows($results) == 1) {
      $_SESSION['username'] = $username;
      $_SESSION['ime'] = $ime;
      $_SESSION['email'] = $email;
      $_SESSION['success'] = "You are now logged in";
      header('location: user.php');
    }else {
        array_push($errors, "Wrong username/password combination");
    }
  }
}

?>

这是html页面：

<?php include('server.php'); ?>
<p id="user_cont" style="color: white;  margin-left: 80%; margin-top: 0; margin-bottom: 0; width: 20%; background-color: black; padding: .5%; font-family: 'Rajdhani', sans-serif; font-size: 140%; border-left: thick red solid;">
                <?php
                    if(isset($_SESSION['username'])){
                        echo $_SESSION['ime'];
                        echo " <a href='logout.php' style='color: red; text-decoration: none;'>Odjavite se</a>";
                    }
                    else echo " <a href='login.php' style='color: white; text-decoration: none;'>Prijavite se</a>";

                ?>

            </p>

$_SESSION['username'] 和 $_SESSION['password'] 没问题，但 $_SESSION['ime']、$_SESSION['prezime']、$_SESSION['email'] 为空。

我检查了 mySQL 数据库，一切都写正确了。

【问题讨论】：

您的查询容易受到 SQL 注入的攻击。考虑使用prepared statements
我知道，这是我学校的一个项目，我会一步一步来。
不要手动散列密码（尤其是 MD5）。相反，请使用 password_hash() 和 password_verify()
我想这个问题发生在登录过程中。你永远不会设置$ime、$prezime 和$email。这就是为什么它们是空的

标签： php mysql

【解决方案1】：

您的程序有 2 个步骤，1. reg_user，2. login_user

我认为您是说登录到您的页面后某些参数为空。但是，您没有从 Select 查询中读取数据。

从查询中读取并存储 SESSION 数据的示例代码：

$row = $results->fetch_assoc();
$_SESSION['ime'] = $row['ime'];
$_SESSION['email'] = $row['email'];
$_SESSION['prezime'] = $row['prezime'];

参考： https://www.w3schools.com/php/func_mysqli_fetch_assoc.asp

最后，请阅读有关 SQL 注入 PDO 或 MYSQLI 的更多信息。

【讨论】：