SQL：条件语法错误和 mysql_fetch_object 误用

Question

我正在尝试使用 SQL 和 PHP 创建登录系统。我有一个包含三个字段的标准数据库：用户名、密码和授权级别。出于某种原因，当我测试代码时，登录失败，即使我使用正确的访问级别和正确的凭据。在我将访问级别检查器添加到我的 PHP 之前，代码可以正常工作，但现在它返回登录失败错误。

    //If there are input validations, redirect back to the login form
    if($errflag) {
        $_SESSION['ERRMSG_ARR'] = $errmsg_arr;
        session_write_close();
        header("location: login-test.php");
        exit();
    }

    //Create query
    $qry="SELECT * FROM members WHERE username='$username' AND password='$password'";
    $result=mysql_query($qry);
    $row = mysql_fetch_object($qry);

    //Check whether the query was successful or not
    if($result) {
        if(mysql_num_rows($result) == 1 && $row->authlevel == "admin") {
            //Login Successful
            session_regenerate_id();
            $member = mysql_fetch_assoc($result);
            $_SESSION['SESS_MEMBER_ID'] = $member['username'];
            $_SESSION['SESS_FIRST_NAME'] = $member['firstname'];
            $_SESSION['SESS_LAST_NAME'] = $member['username'];
            session_write_close();
            header("location: admin_index.php");
            exit();
        } else {
            //Login failed
            header("location: login-failed.php");
        }
    }else {
        die("Query failed");
    }
?>

Answer 1

正如我在评论中所说，使用 PDO 或 mysqli 和准备好的语句。有人可以把它放进去

  '; Select * from members where authLevel = "admin" limit 1 --

对于$username 并以管理员身份登录。这就是为什么

 SELECT * FROM members WHERE username=''; Select * from members where authLevel = "admin" limit 1 -- AND password='ababsdf'

这就是您查询的内容，-- 是 MySql 的注释方式，因此之后的任何内容都将被忽略。基本上我只是告诉它为 authLevel 选择一个具有管理员权限的用户并将其限制为一个结果。

更新 至于答案有两种可能，

• 1 authLevel 错误，

• 2 更有可能是您有重复的用户记录。所以行数检查失败

另外admin 与Admin 或ADMIN 或[space]admin 不同，带有空格。 php中的字符串比较区分大小写。

无论该条件是否失败，因此其中一项或两项都不为真。你所要做的就是这个

  echo 'NumRows: '.mysql_num_rows($result);
  echo "<br>\n";
  echo 'AuthLevel: '.$row->authlevel;

说起来，只要输出它们，它就会变得相当明显。还要注释掉标题重定向（这样你就不会被踢到其他页面）

       //header("location: login-failed.php"); -- un-comment when fixed.

对于 authlevel，您可能希望将其包裹在这样的括号中

    echo 'AuthLevel: ['.$row->authlevel.']';

为什么？因为如果是这样

    [  admin]

然后你可以看到那里有一个空间或什么东西。在你的情况下这样做不是一个坏主意

    if( strtolower( trim( $row->authlevel ) ) == 'admin' ...

PDO 或 mysqli 真的没有那么难，你想要添加至少 sha256 的盐添加加密（或使用 password_hash() ）基本上你的代码看起来像这样

$dsn = 'mysql:host=127.0.0.1;dbname=members;';
$user = 'db_user';
$password = '*******';

try {
    $DB = new PDO($dsn, $user, $password);
} catch (PDOException $e) {
    die('Connection failed: ' . $e->getMessage());
}

$qry="SELECT * FROM members WHERE username=:username";  ///( add field named salt, this is a random string )
//search only for username 

///$DB is pdo database object
//prepare the sql, this 2 step process prevent sql injection by using a placeholder :username instead of the variable directly
$stmt = $DB->prepare( $qry );
 //execute the statement with variables
$stmt->execute( array(':username' => $username ) );
//retrieve the result row as an object.
$row = $stmt->fetch( PDO::FETCH_OBJ );
//Check whether the query was successful or not
if($stmt->rowCount() == 1 ) {
    if($row->authlevel == "admin") {  //if it's not an admin no need to check password
        if( sha256( $row->salt() . $password ) == $row->password ){
             //Check password in php, db is case insensitive unless its a binary field.
            //Login Successful ( obviously youll want to update the member to account for a better password )
            .....
        }else{
            header("location: login-failed.php"); //change for bad password etc.
        }
    } else {
        //Login failed
        header("location: login-failed.php");  //change for invalid user level ( you do not have authorization to view this page ... etc. )
    }
}else {
    die("Query failed"); //change for username not found, or unknown username
}

http://php.net/manual/en/pdo.construct.php

http://php.net/manual/en/function.password-hash.php

除了 PHP7 的安全原因之外，mysql_* 函数已经消失，所以最好不要习惯使用它们。