php - 向当前 PHP 登录表单添加对空输入的验证

Question

我目前有一个表单，用于检查用户名和密码是否存在并记录您并将您重定向到主页。但是，如果您将电子邮件和密码部分留空，您也可以登录该网站。我希望添加某种验证以避免有人仅使用空输入变量。

这就是我所拥有的...

<?php
session_start();
include_once 'config.php';
$email ="";
$userpassword ="";
$errors = 0;

$emailError ="";
$passwordError ="";

if(isset($_SESSION['user'])!="")
{
 header("Location: home.php");
}
if(isset($_POST['loginBtn']))
{
if(!filter_var($_POST["email"], FILTER_VALIDATE_EMAIL))
{
$emailError = "Email is not valid";
$errors = 1;
 }

if(!empty($_POST["password"])) {

$passwordError = "Please enter a Password";
$errors = 1;
}

$email = mysql_real_escape_string($_POST['email']);
$userpassword = mysql_real_escape_string($_POST['password']);
$result=mysql_query("SELECT * FROM users WHERE emailAddress='$email'");
$row=mysql_fetch_array($result);

if($row['password']==md5($userpassword))
{
 $_SESSION['user'] = $row['user_id'];

 header("Location: home.php");
 }
 else
 {
  ?>
    <script>alert('First time visitors, please create an account to play');      </script>
    <?php
  }

  }

  ?>

Answer 1

客户端验证(例如 JavaScript 和 HTML5)可以关闭或通过浏览器直接编辑。始终使用服务器端验证作为最终权威。

此外，在检查登录凭据时，您需要在 where 子句中进行组合检查。 其中用户名='$u_user'并且密码='$u_pass'

当允许重复使用控制列(用户名、电子邮件)时尤其如此。密码并不总是唯一的。

在OP的情况下，对电子邮件的查找只能返回多个结果。

<?php
session_start();
include_once('config.php');
IF (isset($_SESSION['user'])!="") { header("Location: home.php"); }

IF (isset($_POST['loginBtn'])) { // the form was submitted

  $err = ""; // default error as empty
  $email= trim($_POST['email']);
  $password = trim($_POST['password']);

  // validation
  IF (empty($email)) { $err .= "Email is empty<br>";
  }ELSE{
    IF (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
      $err .= "Email is not valid<br>";
    }
  }

  IF (empty($password)) { $err .= "Password is empty<br>"; }

  IF (!empty($err)) {

    // there are errors
    echo("<p>".$err."</p>");

  }ELSE{

    // No errors
    $uemail = mysql_real_escape_string($email);
    $upass = mysql_real_escape_string(md5($password));
    $result = mysql_query("SELECT * FROM users WHERE emailAddress='$uemail' && password = '$upass'");
    IF ($result) {
      // set session
      $row = mysql_fetch_array($result);
      $_SESSION['user'] = $row['user_id'];

    }ELSE{
      echo("<p>Email address and or your password was incorrect.<br>If you do not have an account please create one.</p>");
    }

    // Close DB connection
    mysql_close($Your_db_connection);

    // redirect if session is set
    IF (isset($_SESSION['user'])) { header("Location: home.php"); }

  }

}ELSE{
  // form not submitted

}
?>