Блог

добрый вечер, ребята, сегодня вечером я работал над своим первым сценарием входа в систему и наткнулся на кирпичную стену.

У меня есть скрипт, который отправляет новых пользователей в БД с паролями md5 hash’d, но мне не повезло с аутентификацией и входом в систему частично, любая помощь с благодарностью.

Код приведен ниже;

 <?php
//open the session
session_start();
$sqltable="users";
$pagetitle="User Login";
$menu="no";

require 'inc/dbvars.php';
require 'inc/dafunc.php';

//check to see if someone has pressed the login button
    if(isset($_POST['login']))
    {

//connect to the database
    try {
        $dbh = new PDO("mysql:host=$sqlhost;dbname=$sqldb", $sqluser, $sqlpass);
        $dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
        }
    catch(PDOException $e)
        {
        echo $e->getMessage();
        }

//fetch username and password from form
    $user=$_POST['user'];
    $pass=md5($_POST['pass']);  
//query database and check users's creds
    $query = $dbh->prepare("SELECT * FROM $sqltable WHERE username = $user AND password = $pass"); // carefull with your column name which you declare in the tabel

    $query->execute();


     $_SESSION['username']=$user;
     $_SESSION['userlevel']=$row['level'];
//store login data and time in database
    $datetime = date("Y-m-d H:i:s");

 //   $query = $dbh->prepare("UPDATE ' . $sqltable . ' SET lastlogin =? WHERE user = ?");
 //   $data = array($datetime, $user);
 //   $query->execute($data);
 // right now you shouldn't perform the update query . and you should use primary key column in where caulse in update query
//if everything is correct, this should redirect the user to the confirm page   
    header("location:search.php");
}

//if the shit has hit the fan, deny deny deny
else {
echo "Wrong Username or Password";
}

//login was sucessful, build rest of page
require 'inc/header.php';
?>
<div class="tableForm">
<form name="form1" method="post" action="<?php echo "$self"; ?>">
  <p align="center">Username: 
    <input type="text" name="user" id="user" placeholder="username">
</p>
  <p align="center">Password: 
    <input type="password" name="pass" id="pass" placeholder="password">
</p>
  <p align="center">
    <input type="submit" name="Login" id="Login" value="Login">
    <input type="reset" name="Reset" id="Reset" value="Reset">
  </p>
  <p align="center">
    <input type="submit" name="forgotpass" id="forgotpass" value="Forgot your password?">
  </p>
</form>
</div>
<?php include 'inc/footer.php'; ?>
 

это:

 //query database and check users's creds
     $query = $dbh->prepare('SELECT FROM users WHERE user =?, pass =?');
 

должно быть так:

 //query database and check users's creds
    $query = $dbh->prepare('SELECT * FROM users WHERE user =? AND pass =?');
 

Попробуйте этот код

   <?php
session_start();
$sqlhost = "localhost";
$sqldb = "dbname";
$sqltable="users";
$sqlpass = "";

$pagetitle="User Login";
$menu="no";

require 'inc/dbvars.php';
require 'inc/dafunc.php';

//check to see if someone has pressed the login button
    if(isset($_POST['login']))
    {

//connect to the database
    try {
        $dbh = new PDO("mysql:host=$sqlhost;dbname=$sqldb", $sqluser, $sqlpass);
        $dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
        }
    catch(PDOException $e)
        {
        echo $e->getMessage();
        }

//fetch username and password from form
    $user=$_POST['user'];
    $pass=md5($_POST['pass']);  
//query database and check users's creds
    $query = $dbh->prepare("SELECT FROM users WHERE username = $user AND password = $pass"); // carefull with your column name which you declare in the tabel

    $query->execute();


     $_SESSION['username']=$user;
     $_SESSION['userlevel']=$row['level'];
//store login data and time in database
    $datetime = date("Y-m-d H:i:s");

 //   $query = $dbh->prepare("UPDATE ' . $sqltable . ' SET lastlogin =? WHERE user = ?");
 //   $data = array($datetime, $user);
 //   $query->execute($data);
 // right now you shouldn't perform the update query . and you should use primary key column in where caulse in update query
//if everything is correct, this should redirect the user to the confirm page   
    header("location:search.php");
}

//if the shit has hit the fan, deny deny deny
else {
echo "Wrong Username or Password";
}

//login was sucessful, build rest of page
require 'inc/header.php';
?>
<div class="tableForm">
<form name="form1" method="post" action="<?php echo "$self"; ?>">
  <p align="center">Username: 
    <input type="text" name="user" id="user" placeholder="username">
</p>
  <p align="center">Password: 
    <input type="password" name="pass" id="pass" placeholder="password">
</p>
  <p align="center">
    <input type="submit" name="Login" id="Login" value="Login">
    <input type="reset" name="Reset" id="Reset" value="Reset">
  </p>
  <p align="center">
    <input type="submit" name="forgotpass" id="forgotpass" value="Forgot your password?">
  </p>
</form>
</div>
<?php include 'inc/footer.php'; ?>