密码修改脚本答案

【问题标题】：Password change script密码修改脚本
【发布时间】：2013-10-13 19:35:25
【问题描述】：

好的，所以我正在尝试制作密码更改脚本，但我遇到了一些错误，那么我哪里错了？这是我的表单文档：

<?php
include_once('php_includes/check_login_status.php');
include_once('php_includes/db_conx.php');
if(isset($_SESSION["username"])){
echo "";

}
else {
header("location:login.php");
}
?>

<html>
<head>
<title>Password Change</title>
</head>
<body>
<div id="form">
<form method="POST" id="form1" action="password_system.php"> 
<p>Current password: &nbsp; <input type="password" id="curpass" /> </p>
<p>New password: &nbsp; <input type="password" id="newpass" /> </p>
<p>Confirm new password: &nbsp; <input type="password" id="conpass" /> </p>
<input type="submit" value="Submit">
</form></div>
</body>
</html>

这是更新的password_system.php（动作脚本）：

    <?php
include_once('php_includes/check_login_status.php');
include_once('php_includes/db_conx.php');
if(isset($_SESSION["username"])){
echo "";

}
else {
header("location:login.php");
}
$sql = "SELECT password FROM users WHERE username='$log_username'";
$query = mysqli_query($db_conx, $sql);
$numrows = mysqli_num_rows($query); 
while ($row = $query->fetch_assoc()) {
   $dbpass = $row['password'];
}
$query->free();
$curpass = md5($_POST['curpass']);
$newpass = $_POST['newpass'];
$conpass = $_POST['conpass'];
if ($newpass != $conpass) {
echo "Your passwords don't match!";
exit();
} else {
echo "Ohkay";
$newpas = true;
$newpassmd5ed = md5($newpass);
}
if ($curpass != $dbpass) {
echo "Your current password is incorrent!";
exit();
} else {
echo "Okay";
$curok = true;
}
if ($curok and $newpas == true) {
$sql = "UPDATE users
SET password = '$newpassmd5ed' 
WHERE username= '$log_username'";
$query = mysqli_query($db_conx, $sql);
}
?>

我现在明白了：

哦，您当前的密码不正确！

check_login_status.php

<?php
session_start();
include_once("db_conx.php");
// Files that inculde this file at the very top would NOT require 
// connection to database or session_start(), be careful.
// Initialize some vars
$user_ok = false;
$log_id = "";
$log_username = "";
$log_password = "";
// User Verify function
function evalLoggedUser($conx,$id,$u,$p){
    $sql = "SELECT ip FROM users WHERE id='$id' AND username='$u' AND password='$p' AND activated='1' LIMIT 1";
    $query = mysqli_query($conx, $sql);
    $numrows = mysqli_num_rows($query);
    if($numrows > 0){
        return true;
    }
}
if(isset($_SESSION["userid"]) && isset($_SESSION["username"]) && isset($_SESSION["password"])) {
    $log_id = preg_replace('#[^0-9]#', '', $_SESSION['userid']);
    $log_username = preg_replace('#[^a-z0-9]#i', '', $_SESSION['username']);
    $log_password = preg_replace('#[^a-z0-9]#i', '', $_SESSION['password']);
    // Verify the user
    $user_ok = evalLoggedUser($db_conx,$log_id,$log_username,$log_password);
} else if(isset($_COOKIE["id"]) && isset($_COOKIE["user"]) && isset($_COOKIE["pass"])){
    $_SESSION['userid'] = preg_replace('#[^0-9]#', '', $_COOKIE['id']);
    $_SESSION['username'] = preg_replace('#[^a-z0-9]#i', '', $_COOKIE['user']);
    $_SESSION['password'] = preg_replace('#[^a-z0-9]#i', '', $_COOKIE['pass']);
    $log_id = $_SESSION['userid'];
    $log_username = $_SESSION['username'];
    $log_password = $_SESSION['password'];
    // Verify the user
    $user_ok = evalLoggedUser($db_conx,$log_id,$log_username,$log_password);
    if($user_ok == true){
        // Update their lastlogin datetime field
        $sql = "UPDATE users SET lastlogin=now() WHERE id='$log_id' LIMIT 1";
        $query = mysqli_query($db_conx, $sql);
    }
}

?>

【问题讨论】：

您是否在 Google 上搜索过该错误？您尝试解决什么问题？
你在哪里设置$log_username？
@Amal in check_login_status.php（我刚刚添加了）
你从来没有设置过 $result。不过，您还有其他多个问题...
@user2092317 我更新了脚本，所以现在看看（而不是 $result -> fetch_assoc 我的意思是放 mysql_fetch_assoc

标签： php mysql password-recovery

【解决方案1】：

您错误地使用 MySQLi。

$query = mysqli_query($db_conx, $sql);
$numrows = mysqli_num_rows($query); 
while ($row = $result->fetch_assoc($query)) {
    echo $row['password'];
}

应该是：

$query = mysqli_query($db_conx, $sql);
$numrows = mysqli_num_rows($query); 
while ($row = $query->fetch_assoc()) {
    echo $row['password'];
}
$query->free();

【讨论】：

谢谢，它没有显示警告，但我仍然收到：“哦，您当前的密码不正确！”我现在哪里错了？我把 $dbpass 而不是 echo 放在 $row['password'] 和后来 if ($curpass != $dbpass) { echo "Your current password is incorrent!";出口（）; } 其他 { 回声“好的”； if ($newpass != $conpass) { echo "你的密码不匹配！";出口（）; } 其他 { 回声“哦”； $新帕斯=真； $newpassmd5ed = md5($newpass); }