php mysql重定向脚本甚至会注销经过身份验证的用户答案

【问题标题】：php mysql redirect script logs out even authenticated usersphp mysql重定向脚本甚至会注销经过身份验证的用户
【发布时间】：2021-03-01 09:59:58
【问题描述】：

我尝试搜索其他类似的问题，但找不到适合我的解决方案，所以如果问题重复，我很抱歉，我也只有 2 个月大，所以任何来自我前辈的学习机会都是一种祝福。在一个应该保存现场操作员及其设备记录的 Web 应用程序上工作，框架已经建立，但我面临一些问题： 1. 登录有 2 个身份验证级别，“管理员”和“操作”，我让它比我希望的工作得更好，直到我意识到如果有人将链接复制到只有在登录后才能访问的页面，他们就可以访问。我检查了这里和其他地方，发现它与会话有关，我没有使用它们，因为我错误地认为我已经设置了 php.ini 自动会话，但那是在我从我正在使用的免费服务器切换之前我将文件控制到付费共享服务器的位置，因此我现在包含会话并编写了一个脚本（header.php），以检查用户是否注册了会话，或者将它们重定向到登录页面。问题是当我在要保护的页面顶部包含脚本时，即使经过身份验证的用户也会被重定向回登录页面，如果我不包含脚本，身份验证很好，但受限页面不受保护使用直接链接。下面是代码；

认证码(authentication3.php)

<?php
session_start();
// $con = new mysqli("host", "username", "password", "databaseName"); 
include('connection.php');
if (isset($_POST['user']) && isset($_POST['pass'])) {

    //Checking user existing in the database or not
    $query = "SELECT * FROM users WHERE username = ? and password = ?";

    //use prepared statement
    $stmt = $con->prepare($query);
    $stmt->bind_param('ss', $_POST['user'], $_POST['pass']);
    $stmt->execute();
    $result = $stmt->get_result();

    if ($result->num_rows !== 0) {
          $_SESSION['user'] = $username;
        //fetch user from database.
        $user = $result->fetch_assoc();

        //check if user is an admin.
        if($user['level'] === "admin") {
            $_SESSION['user'] = $username;
            $_SESSION['loggedin'] = TRUE;
             {
   
      echo"<script>window.location.href='http://www.pkmcapitalvendingkits.com/welcome.php'</script>";}
        //admin's page
        }
         //check if user is a normal user.
        if($user['level'] === "op") {
            $_SESSION['user'] = $username;
            {  
              header("Location: welcome1.php");}
              //user's page
        }

    } else {
        echo '<div class="alert">Username/password is incorrect. Click <a href="index.php">here</a> to log-in.</div>';
    }
    //free memory used by the prepared statement.
    
} else { 
    //username and password not provided.
};
?>

数据库连接(),connection.php

<?php      
$host = "localhost";  
$user = "ronaldschwartzenneger";  
$password = "xxxxxxxxxxxx";  
$db_name = "my_db";  
  
$con = mysqli_connect($host, $user, $password, $db_name);  
if(mysqli_connect_errno()) {  
    die("Failed to connect with MySQL: ". mysqli_connect_error());  
}

登录页面代码(index.php)

  <?php
session_start();
?>

<!-- begin snippet: js hide: false console: true babel: false -->

    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://w3.org/TR/html4/loose.dtd">
     <html>
       
     <head>
        <title>Operations Centre</title>
        <link rel="stylesheet" type="text/css" href="style5.css" />

        </head>
    <body>
       
            <div id="header">
            <h1>Operations Centre</h1>
        </div>
        
        <div id="container">
            <div id="bar"> 
            <form name="f1" action = "authentication3.php" onsubmit = "return validation()" method = "POST">  
                <p>  
                    <label> UserName: </label>  
                    <input type = "text" id ="user" name  = "user" />  
                </p>  
                <p>  
                    <label> Password: </label>  
                    <input type = "password" id ="pass" name  = "pass" />  
                </p>  
                <p>     
                    <input type =  "submit" id = "btn" value = "Login" />  
                </p>  
            </form>  
        </div> 
        <div id="main">

        <h1>Welcome</h1>
        <br>
        <ul>
            <li>
                Welcome to Operations Centre.
            </li>
            <div id="status">
            <li>Last Message Sent To OP</li>        </div>
        </ul>           </div>
        // validation for empty field   
        <script>  
                function validation()  
                {  
                    var id=document.f1.user.value;  
                    var ps=document.f1.pass.value;  
                    if(id.length=="" && ps.length=="") {  
                        alert("User Name and Password fields are empty");  
                        return false;  
                    }  
                    else  
                    {  
                        if(id.length=="") {  
                            alert("User Name is empty");  
                            return false;  
                        }   
                        if (ps.length=="") {  
                        alert("Password field is empty");  
                        return false;  
                        }  
                    }                             
                }  
            </script>  
    </body>     
    </html>

欢迎页面代码(welcome.php)

&lt;!-- begin snippet: js hide: false console: true babel: false --&gt;

    <html>
    <head>
        <title>Operations Centre</title>
        <link rel="stylesheet" type="text/css" href="style5.css" />
        <script language='JavaScript' src='calendar3.js'></script>

    <script type="text/javascript">
        function showUser(str) {
      if (str == "") {
        document.getElementById("txtHint").innerHTML = "";
        return;
      } else {
        var xmlhttp = new XMLHttpRequest();
        xmlhttp.onreadystatechange = function() {
          if (xmlhttp.readyState == 4 && xmlhttp.status == 200) {
            document.getElementById("txtHint").innerHTML = xmlhttp.responseText;
          }
        };
        xmlhttp.open("GET","getbanking.php?q="+str,true);
        xmlhttp.send();
      }
    }
    </script>




    </head>
    <body>

    <?php
    include('common.php');
    ?>



    <div id="main"><h1>Banking Report</h1>
    <form>
    <select name="users" onchange="showUser(this.value)">
      <option value="">Select operator:</option>
      <option value="manager">Manager</option>
      <option value="zono">Zono</option>
      <option value="op2">OP2</option>
      <option value="op3">OP3</option>
      </select><br><br>
      <b>Start Date (YYYY-MM-DD):</b>&nbsp;&nbsp;<input type = 'text' name='startdate' maxlength = 10 size = 10 value = '2021-02-12'>&nbsp<a href='javascript:calSD.popup();'><img src='img/cal.gif' width='16' height='16' border='0' alt='Click Here to Pick a Start Date'></a><br><script language='JavaScript'>var calSD = new calendar3(document.forms['loginform'].elements['startdate']);calSD.year_scroll = true;calSD.time_comp = false;</script><br><b>End Date (YYYY-MM-DD):</b>&nbsp;&nbsp;<input type = 'text' name='enddate' maxlength = 10 size = 10 value = '2021-02-12'>&nbsp<a href='javascript:calED.popup();'><img src='img/cal.gif' width='16' height='16' border='0' alt='Click Here to Pick an End Date'></a><br><script language='JavaScript'>var calED = new calendar3(document.forms['loginform'].elements['enddate']);calED.year_scroll = true;calED.time_comp = false;</script><br><br><input type='submit' name='GetDataBDBut' value='Get Data (By Date)'><input type='submit' name='GetDataBOBut' value='Get Data (By Operator)'>
    </form>
    <br>
    <div id="txtHint"><b>Select Operator and wait...</b></div></div>

    </body>
    </html>






common.php(which is included in welcome.php)

        



    <div id="header">
            <h1>PKM Operations Centre</h1>
        </div>
        
        <div id="container">
            <div id="bar">
                <table width=100%><tr><th colspan = 2>Login Details:</th></tr><tr><th>Name:</th><td>Peter Keith Mweruka</td></tr></table>      <form name = 'logoutform' action = "logout.php" method = "post">
               <input type='submit' class='MenuButton' name='submit' value="Logout">
           </form>
           
                                            <br>

                                    
                                        <form name = 'generic' action = "" method = "post">
                                            <input type='submit' class='MenuButton' name='BankingRepBut' value= "Banking Report" formaction= "bankingreport.php">
                                            <input type='submit' class='MenuButton' name='TransactionsBut' value=   "Banking Transactions" formaction= "transactions.php">
                                                <input type='submit' class='MenuButton' name='AirtimeBut' value=    "Request Airtime" formaction= "airtimerequest.php">
                                            <input type='submit' class='MenuButton' name='OperatorBut' value= "Operator Info" formaction= "op.php">
                                            <input type='submit' class='MenuButton' name='Airtime0RepBut' value=    "Airtime Report" formaction= "airtimereport0.php">
                                        
                                            
                                            
                                            
                                            <input type='submit' class='MenuButton' name='BarredOpBut' value=   "Barred Operators" formaction= "barred.php">
                                            <input type='submit' class='MenuButton' name='ReportBut' value= 'RunDown Report' formaction= "rundown.php">
                                                <input type='submit' class='MenuButton' name='AddbankerBut' value= "Privileges" formaction= "privs.php">
                                            <input type='submit' class='MenuButton' name='BarringBut' value=    "Barring Limits" formaction= "barring.php">
                                            <input type='submit' class='MenuButton' name='PerformanceBut' value=    "Op Performance Review" formaction= "perform.php">
                                                <input type='submit' class='MenuButton' name='MachinesBut' value=   'Manage Machines' formaction= "machine.php">
                                                        <input type='submit' class='MenuButton' name='BoardsBut' value= 'Manage Boards' formaction= "boards.php">
                                            <input type='submit' class='MenuButton' name='AddOpBut' value=  "Add or Remove Operator" formaction= "addop.php">
                                            <input type='submit' class='MenuButton' name='CostsBut' value=  "Adjust Song or Video Cost" formaction= "costs.php">
                                            <input type='submit' class='MenuButton' name='OverviewBut' value=   "Records Summary" formaction= "records.php">
                                            <input type='submit' class='MenuButton' name='LoansBut' value=  'Manage Loans' formaction= "loans.php">                                 
                                            <input type='submit' class='MenuButton' name='instructionsBut' value= "Instructions" formaction= "instructions.php">    
                                        </form>
                                                </div>

header.php（我试图用来检查用户是否登录的脚本）

  <?php
session_start();
    include('connection.php');
    
    if(!$_SESSION['user']) {
 header("Location: index.php");
}
    {
      
        die;
    } 

?>

我正在查询的数据库表本地主机/my_db/users/

从users中选择*

id|username|password|level|created_at

如果我包含 header.php，即使经过身份验证的用户也会被重定向到 index.php

【问题讨论】：

切勿以明文形式或使用 MD5/SHA1 存储密码！ 仅存储使用 PHP 的 password_hash() 创建的密码哈希，然后您可以使用 password_verify() 进行验证。看看这个帖子：How to use password_hash 并了解更多关于bcrypt & password hashing in PHP

标签： javascript php html mysql

【解决方案1】：

header.php 应该包含在您需要保护的每个页面中。

<?php
session_start();
include('connection.php');

if(!isset($_SESSION) || empty($_SESSION['user'])) {
    header("Location: index.php");
    die();
}

?>

登录时缺少管理变量 $username，请使用 $_POST['user'] 或更好的 $user['username']。

<?php
session_start();
// $con = new mysqli("host", "username", "password", "databaseName"); 
include('connection.php');
if (isset($_POST['user']) && isset($_POST['pass'])) {

    //Checking user existing in the database or not
    $query = "SELECT * FROM users WHERE username = ? and password = ?";

    //use prepared statement
    $stmt = $con->prepare($query);
    $stmt->bind_param('ss', $_POST['user'], $_POST['pass']);
    $stmt->execute();
    $result = $stmt->get_result();

    if ($result->num_rows !== 0) {
        //fetch user from database.
        $user = $result->fetch_assoc();
        $_SESSION['user'] = $user['username'];
        $_SESSION['loggedin'] = TRUE;
        $_SESSION['userType'] = $user['level'];
        //check if user is an admin.
        if ($user['level'] === "admin") {
            echo "<script>window.location.href='http://www.pkmcapitalvendingkits.com/welcome.php'</script>";
        }
        //check if user is a normal user.
        if ($user['level'] === "op") {
            header("Location: welcome1.php");
        }

    } else {
        echo '<div class="alert">Username/password is incorrect. Click <a href="index.php">here</a> to log-in.</div>';
    }
    $stmt->close();
    //free memory used by the prepared statement.
} else {
    //username and password not provided.
};
?>

您还需要保护管理员或操作用户。如果welcome.php 仅适用于管理员，您需要检查

<?php
session_start();
include('connection.php');

if(!isset($_SESSION) || empty($_SESSION['user'])) {
    header("Location: index.php");
    die();
}
if($_SESSION['userType'] != 'admin')) {
    header("Location: welcome1.php");
    die();
}
?>

并且welcome1.php 应该使用op 和admin 访问我猜比原来的header.php 好

【讨论】：

感谢您的快速响应，进行了所有更改，在欢迎页面和身份验证页面中都包含了 header.php 文件，不幸的是仍然按照原来的方式运行，即使经过身份验证的用户也被重定向到登录，可以吗是我想念的其他东西吗？
你改变了 authentication3.php 吗？做 var_dump($_SESSION) 看看你得到了什么
不要把 header.php 放到 authentication3.php 你还没有设置 $_SESSION
是的，我完全复制了你的，我添加了 var_dump($_SESSION);在 authentication3 文件的末尾，这不是这样做的方法吗？没有输出，只是重定向到登录
让我先检查一下最后的两个变化