【发布时间】:2014-02-13 14:00:33
【问题描述】:
我想了解您如何显示在线用户?一旦他们登录,我希望它显示在我的会员页面上,现在我得到了多少用户。如果用户关闭浏览器或注销,我也希望超时,它不会显示任何在线用户,这是所有成员的代码...
<?
if ($_GET[user] != "") {
$check_query = mysql_query("SELECT * FROM users WHERE username='$lowerusername'");
if (mysql_num_rows($check_query) != "0") {
} else {
header("Location: /usernotfound.php");
}
}
?>
<?
$username = $_SESSION['membersusername'];
$check_query3 = mysql_query("SELECT * FROM users WHERE username='$username'");
while ($display = mysql_fetch_array($check_query3)) {
$bio = $display['bio'];
}
?>
<?
if ($_GET[user] != ""){
$check_query = mysql_query("SELECT * FROM users WHERE username='$lowerusername'");
while ($display = mysql_fetch_array($check_query)) {
$twitter = $display['twitter'];
$facebook = $display['facebook'];
$tinychat = $display['tinychat'];
$vaughnlive= $display['vaughnlive'];
$uploadbanner = $display['uploadbanner'];
$uploadbg= $display['uploadbg'];
$backgroundcolor = $display['backgroundcolor'];
$bgp = $display['bgp'];
$bgr = $display['bgr'];
$bga = $display['bga'];
$btc = $display['btc'];
$image = $display['image'];
$status1 = $display['status'];
$djname2 = ":: $djname2 Profile";
$djname3 = "$djname3";
$djname = "<strong>Name:</strong> $name";
$age = "<strong>DOB:</strong> $age1";
$email = "<strong>E-Mail:</strong> <a href='mailto:$email1'>$email1</a>";
$year = date('d/m/Y');
$totalage = $year-$age1;
}}
?>
<?
if ($_GET[user] != ""){
$check_query = mysql_query("SELECT * FROM profiles WHERE username='$lowerusername'");
while ($display = mysql_fetch_array($check_query)) {
$twitter = $display['twitter'];
$facebook = $display['facebook'];
$tinychat = $display['tinychat'];
$vaughnlive= $display['vaughnlive'];
$uploadbanner = $display['uploadbanner'];
$uploadbg= $display['uploadbg'];
$backgroundcolor = $display['backgroundcolor'];
$bgp = $display['bgp'];
$bgr = $display['bgr'];
$bga = $display['bga'];
$btc = $display['btc'];
$username = $display['username'];
$image = $display['image'];
}}
?>
<? $check_query = mysql_query("SELECT * FROM profiles WHERE username='$_SESSION[membersusername]'");
while ($display = mysql_fetch_array($check_query)) {
$image1 = $display['image'];
if ($image1 == "") {
$image1 = "profile/nophoto.gif";
} else {
$image1 = "profile/$username/$image1";
}}
?>
<?
$check_query_all = mysql_query("SELECT * FROM users WHERE hiddenauth='no' AND auth='yes' ORDER BY id DESC");
while ($display = mysql_fetch_array($check_query_all)) {
$allmembers = $display['name'];
$allusername = $display['username'];
$allbio = $display['bio'];
$allage = $display['age'];
// get more stuff above if u need
$check_query_all2 = mysql_query("SELECT * FROM profiles WHERE username='$allusername'");
while ($display = mysql_fetch_array($check_query_all2)) {
$allimage = $display['image'];
$alllocation = $display['location'];
// Check Album Photo's
$check_amount = mysql_query("SELECT * FROM users WHERE hiddenauth='no' AND auth='yes'");
$num_djs_total = mysql_num_rows($check_amount);
// CHECK IF IMAGE OR NOT
if ($allimage == "") {
$allcheckedimage = "nopic.gif"; }
// CHECK IF IMAGE OR NOT
if ($allimage != "") {
$allcheckedimage = "$allusername/$allimage"; }
// CHECK IF location OR NOT
if ($alllocation == "") {
$allcheckedlocation = "No Idea"; }
// CHECK IF location OR NOT
if ($alllocation != "") {
$allcheckedlocation = "$alllocation"; }
// CHECK IF mini bio OR NOT
if ($allbio == "") {
$allcheckedbio = "Something about your show."; }
// CHECK IF mini bio OR NOT
if ($allbio != "") {
$allcheckedbio = "$allbio"; }
$listalldjs .= "<table class='inlineTable' width='452' border='0'>
<tr>
<td width='20%'><img src='$domain/profile/$allcheckedimage' width='180' height='173'/></td>
<td width='83%'><b>Username:</b> $allusername<br /><b>Location:</b> $allcheckedlocation<br /><b>Show Description:</b><br>$allcheckedbio<div align='right'><a href='$domain/$allusername'/>View Channel</a>
</div> </td>
</tr>
</table>";
}}
?>
这是登录代码...
<?php session_start(); ?>
<? include "includes/dbconfig.php"; ?>
<? include "includes/loggedin_config.php"; ?>
<?
$lowerusername = strtolower($_POST[username]);
// MEMBERS LOGIN CHECK IF USER EXISTS :D
if ($_GET[action] == "login") {
$check_query = mysql_query("SELECT * FROM users WHERE username='$lowerusername' AND password='$_POST[password]' AND auth='yes'");
if (mysql_num_rows($check_query) != "1") {
$error = "Incorrect details! or You have not authorized your account!";
} else {
$_SESSION[ipaddress] = $_SERVER['REMOTE_ADDR'];
$_SESSION[membersusername] = $lowerusername;
header('Location: main.php');
}
}
?>
谁能帮我制作一个仅限在线的脚本而不是全部成员?如果是这样,我需要向 MySQL 表添加什么?
谢谢
【问题讨论】:
-
注意:您的登录 SQL 查询不是 SQL 注入安全的,因为看起来您在查询中使用输入数据而没有过滤:
AND password='$_POST[password]'。 -
应过滤您想在数据库查询中使用的每个用户定义变量,这意味着使用
strip_tags()删除html 和php-tags 以防止XSS 攻击并使用@987654325 屏蔽引号@ 防止 SQL 注入:$username = strip_tags(addslashes($username));有更好的方法,但这基本上可以保护您的查询。