java - 登录到远程 mysql 数据库的身份验证

Question

我这里有这行代码。

我的java代码:

btnLogin.setOnClickListener(new View.OnClickListener() {

     @Override
         $public void onClick(View v) {

        ArrayList<NameValuePair> postParameters = new ArrayList<NameValuePair>();  
        postParameters.add(new BasicNameValuePair("username", txtUsername.getText().toString()));  
        postParameters.add(new BasicNameValuePair("password", txtPassword.getText().toString())); 




    //String valid = "1";  
    String response = null;  
    try {  
    response = CustomHttpClient.executeHttpPost("http://www.sampleweb.com/imba.php", postParameters);  
    String res=response.toString();  
    // res = res.trim();  
    res= res.replaceAll("\\s+","");  
    //error.setText(res);  
    if(res.equals("1")){
    txtError.setText("Correct Username or Password"); 
    //Intent i = new Intent(CDroidMonitoringActivity.this, MenuClass.class);
    //startActivity(i);
    }
    else {
    txtError.setText("Sorry!! Incorrect Username or Password");  
    } 
    } catch (Exception e) { 
    txtUsername.setText(e.toString());  

    }

}
                });
            }

我的 php 脚本代码:

   <?php
     $un=$_POST['username'];
     $pw=$_POST['password'];

     $user = ‘bduser’;
     $pswd = ‘dbpwd’;
     $db = ‘phplogin’;
     $conn = mysql_connect("localhost","root","");
     mysql_select_db($db, $conn);

     $query = mysql_query("SELECT * FROM user WHERE username = '$un' AND password = '$pw'");
     $result = mysql_query($query) or die("Unable to verify user because : " . mysql_error());

      if(mysql_num_rows($result) == 1)

     echo 1; // for correct login response
     else
     echo 0; // for incorrect login response
      ?>

我对这段代码有疑问。在我的 android 代码中，当我尝试将 res.equals 更改为包含时。它总是说正确的密码，但如果我不更改它，它会说密码不正确。我不知道我的 java 代码或我的 php 代码有什么问题。真的需要帮助。

Answer 1

看起来错误是在 PHP 代码中。

更改以下行:-

来自:

 $query = mysql_query("SELECT * FROM user WHERE username = '$un' AND password = '$pw'");

收件人:

$query = "SELECT * FROM user WHERE username = '$un' AND password = '$pw'";

您还应该考虑进行更改以防止 SQL 注入(inject):-

$query = sprintf("SELECT * FROM user WHERE username = 
    WHERE username='%s' AND password='%s'",
    mysql_real_escape_string($un),
    mysql_real_escape_string($pw));