【发布时间】:2026-01-07 11:10:02
【问题描述】:
我将这段 PHP 代码安装在我还安装了数据库的服务器上。当我尝试通过 URL http://ptyxiaki2016.eu.pn/login.php?email=tade&password=1234 运行它时,所有值都为 NULL。
tade 1234 {"error":false,"uid":null,"user":{"name":null,"surname":null,"country":null,"email":null,"password" :null,"电话":null}}
我的 PHP 代码如下:
<?php
require_once 'DB_Functions.php';
require_once 'DB_Connect.php';
$db = new DB_Functions();
// json response array
$response = array("error" => FALSE);
if (isset($_GET['email']) && isset($_GET['password'])) {
// receiving the post params
$email = $_GET['email'];
$password = $_GET['password'];
// get the user by email and password
$user = $db->getUserByEmailAndPassword($email, $password);
if ($user != false) {
// user is found
$response["uid"] = $user["oid"];
$response["error"] = FALSE;
$response["uid"] = $user["oid"];
$response["user"]["name"] = $user["name"];
$response["user"]["surname"] = $user["surname"];
$response["user"]["country"] = $user["country"];
$response["user"]["email"] = $user["email"];
$response["user"]["password"] = $user["password"];
$response["user"]["telephone"] = $user["telephone"];
echo json_encode($response);
} else {
// user is not found with the credentials
$response["error"] = TRUE;
$response["error_msg"] = "Login credentials are wrong. Please try again!";
echo json_encode($response);
}
} else {
// required post params is missing
$response["error"] = TRUE;
$response["error_msg"] = "Required parameters email or password is missing!";
echo json_encode($response);
}
?>
这就是我在登录时调用的函数getUserByEmailAndPassword()。它在我包含的 DB_Functions.php 中。
public function getUserByEmailAndPassword($email, $password) {
$stmt = $this->conn->prepare("SELECT * FROM owner WHERE email = ?");
$stmt->bind_param("s", $email);
if ($stmt->execute()) {
$user = $stmt->bind_result($oid, $name, $surname, $country, $email, $password, $telephone);
while ($stmt->fetch()) {
printf("%s %s\n", $email, $password);
}
$stmt->close();
return $user;
}
}
我在这里缺少什么?我的数据库没问题,但是,我该如何检索数据?
【问题讨论】:
-
永远不要通过 GET 请求以纯文本形式传输密码和登录凭据。这是一个严重的安全风险。
-
我必须传输什么请求?
-
当然是通过 POST。
-
如果我使用 POST 会出错,这就是我使用 GET 的原因
-
这是我听过的最糟糕的借口之一。您基本上是让人们将他们的密码存储在他们的浏览器历史记录中,并且完全可以从网络流量中嗅出。用
$_POST替换$_GET并使用<form method="post">有什么困难?