【发布时间】：2018-09-18 21:24:40
【问题描述】：
我正在尝试为练习制作更新密码页面。我创建了一个旧密码字段、一个新密码字段和一个重复密码字段。 我自己创建了这个。如果你们能告诉我我的代码中的错误是什么，我会很高兴，因为我无法使页面正常工作。此外，知道在安全方面我可以做得更好会很有趣。（我还有一个登录、注册、欢迎页面都可以） 你好 session.php：
<?php
include('connection.php');
session_start();
$user_check = $_SESSION['login_user'];
$ses_sql = mysqli_query($db,"select * from clients where email = '$user_check'");
$row = mysqli_fetch_array($ses_sql,MYSQLI_ASSOC);
$_SESSION['email']=$row['email'];
$_SESSION['username']=$row['username'];
$_SESSION['firstname']=$row['firstname'];
$_SESSION['lastname']=$row['lastname'];
$_SESSION['birthdate']=$row['birthdate'];
$_SESSION['street']=$row['street'];
$_SESSION['streetnr']=$row['streetnr'];
$_SESSION['city']=$row['city'];
$_SESSION['plzz']=$row['plzz'];
if(!isset($_SESSION['login_user'])){
header("location:http://localhost:81/Left_over_youth_website/pages/login.php");
}
?> Connection.php：
<?php
define('DB_SERVER', 'localhost');
define('DB_USERNAME', 'root');
define('DB_PASSWORD', '');
define('DB_DATABASE', 'leftoveryouth');
$db = mysqli_connect(DB_SERVER,DB_USERNAME,DB_PASSWORD,DB_DATABASE);
?>
改变pd：
<?php
include("../php/session.php");
?>
<html>
<head>
<title>Forgot Password</title>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=9; IE=8; IE=7; IE=EDGE" />
<meta content="width=device-width, initial-scale=1, maximum-scale=1, minimum-scale=1, user-scalable=no, minimal-ui" name="viewport">
<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js"></script>
<script type="text/javascript" src="../scripts/newpd.js"></script>
<link rel="stylesheet" href="../css/changepd.css">
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css" integrity="sha384-1q8mTJOASx8j1Au+a5WDVnPi2lkFfwwEAa8hDDdjZlpLegxhjVME1fgjWPGmkzs7" crossorigin="anonymous">
</head>
<body class="img">
<div class="placeholder">
<h1 class="logo"><a href="/index.html"class="alogo">Leftover Youth</a></h1>
<img class="logoo" src="../img/logoo.png" alt="firstimage">
<form class="form">
<hr class="verticalline">
<input class="oldpd" id="oldpd" value="Old Password"
onblur="this.value'Old Password':this.value;"
onfocus="this.select()"
onclick="if (this.value=='Old Password'){this.value=''; this.type='password'}">
<input class="newpd shine" id="newpd" value="New Password"
onblur="this.value'New Password':this.value;"
onfocus="this.select()"
onclick="if (this.value=='New Password'){this.value=''; this.type='password'}">
<input class="repeatpd shine" id="repeatpd" value="Repeat Password"
onblur="this.value'Repeat Password':this.value;"
onfocus="this.select()"
onclick="if (this.value=='Repeat Password'){this.value=''; this.type='password'}">
<p hidden style="color:red;" id="pdontmatch">☒ Password doesn't match</p>
<p hidden style="color:lightgreen;" id="pmatch">☑ Password matches</p>
<?php
if($_SERVER["REQUEST_METHOD"] == "POST") {
$myoldpassword = sha1($_POST['oldpd']);
$newpassword = sha1($_POST['newpd']);
$repeatpassword = sha1($_POST['repeatpd']);
$sql = "SELECT password FROM clients WHERE password = '$myoldpassword'";
$result = mysqli_query($db,$sql);
if($result){
if($newpassword===repeatpassword){
$_SESSION["password"] = $newpassword;
$update = "UPDATE CLIENTS SET password = mynewpassword";
header("location:http://localhost:81/Left_over_youth_website/php/logout.php");
}
else{
echo('<p>password not updated</p>');
}
}
}
?>
<input id="button" type="button" value="Submit" onclick="ausgabe(); marginn();">
<script>
function marginn(){
document.getElementById('button').style.marginTop = "5px";
}
</script>
</form>
</div>
</body>
</html>
如果您需要进一步的解释或代码，请告诉我。
【问题讨论】：
-
针对初学者的 SQL 注入。在您的登录表单中输入
x'; DROP TABLE clients; --。实际上，不要那样做。 unixwiz.net/techtips/sql-injection.html -
您应该在每次查询将 $POST 变量传递到数据库之前对其进行清理（防止 SQL 注入）。
标签： php sql session login passwords