php - 即使没有哈希也不读取数据库

Question

我试图找出为什么这个脚本运行到“登录失败”并退出。从技术上讲，我知道为什么(不匹配，但有匹配)。最初我认为这可能是密码哈希的问题，但我已将其删除以测试密码。我尝试手动将密码和用户名放入数据库中以获得匹配。还有其他原因导致此功能无法正常工作吗？这些是我正在运行的脚本。

Signin.php

<?php
include_once("includes/check_login_status.php");
// If user is already logged in, header that weenis away
if($user_ok == true){
header("location: user.php?u=".$_SESSION["username"]);
    exit();
}
?><?php
// AJAX CALLS THIS LOGIN CODE TO EXECUTE
if(isset($_POST["e"])){
// CONNECT TO THE DATABASE
include_once("includes/db_conx.php");
// GATHER THE POSTED DATA INTO LOCAL VARIABLES AND SANITIZE
$e = mysqli_real_escape_string($db_conx, $_POST['e']);
$p = mysqli_real_escape_string($db_conx, $_POST['p']);
// GET USER IP ADDRESS
    $ip = preg_replace('#[^0-9.]#', '', getenv('REMOTE_ADDR'));
// FORM DATA ERROR HANDLING
if($e == "" || $p == ""){
echo "login_failed";
        exit();
} else {
// END FORM DATA ERROR HANDLING
$sql = "SELECT id, username, password FROM transactions WHERE email='$e' AND activated='1' LIMIT 1";
        $query = mysqli_query($db_conx, $sql);
        $row = mysqli_fetch_row($query);
$db_id = $row[0];
$db_username = $row[1];
        $db_pass_str = $row[2];
if($p != $db_pass_str){
echo "login_faileda";
            exit();
} else {
// CREATE THEIR SESSIONS AND COOKIES
$_SESSION['userid'] = $db_id;
$_SESSION['username'] = $db_username;
$_SESSION['password'] = $db_pass_str;
setcookie("id", $db_id, strtotime( '+30 days' ), "/", "", "", TRUE);
setcookie("user", $db_username, strtotime( '+30 days' ), "/", "", "", TRUE);
    setcookie("pass", $db_pass_str, strtotime( '+30 days' ), "/", "", "", TRUE); 
// UPDATE THEIR "IP" AND "LASTLOGIN" FIELDS
$sql = "UPDATE transactions SET ip='$ip', lastlogin=now() WHERE username='$db_username' LIMIT 1";
            $query = mysqli_query($db_conx, $sql);
echo $db_username;
   exit();
}
}
exit();
}
?>
<?php include_once("./includes/site-opener.php");?>
<title>Sign In</title>
<script src="js/main.js"></script>
<script src="js/ajax.js"></script>
<script>
function emptyElement(x){
_(x).innerHTML = "";
}
function login(){
var e = _("email").value;
var p = _("password").value;
if(e == "" || p == ""){
_("status").innerHTML = "Fill out all of the form data";
} else {
_("loginbtn").style.display = "none";
_("status").innerHTML = 'please wait ...';
var ajax = ajaxObj("POST", "signin.php");
        ajax.onreadystatechange = function() {
       if(ajaxReturn(ajax) == true) {
           if(ajax.responseText == "login_failed"){
_("status").innerHTML = "Login unsuccessful, please try again.";
_("loginbtn").style.display = "block";
} 
           if(ajax.responseText == "login_faileda"){
_("status").innerHTML = "Next One";
_("loginbtn").style.display = "block";
} 
else {
window.location = "user.php?u="+ajax.responseText;
}
       }
        }
        ajax.send("e="+e+"&p="+p);
}
}
</script>

check_login_status.php

<?php
session_start();
include_once("db_conx.php");
// Files that inculde this file at the very top would NOT require 
// connection to database or session_start(), be careful.
// Initialize some vars
$user_ok = false;
$log_id = "";
$log_username = "";
$log_password = "";
// User Verify function
function evalLoggedUser($conx,$id,$u,$p){
$sql = "SELECT ip FROM users WHERE id='$id' AND username='$u' AND password='$p' AND activated='1' LIMIT 1";
    $query = mysqli_query($conx, $sql);
    $numrows = mysqli_num_rows($query);
if($numrows > 0){
return true;
}
}
if(isset($_SESSION["userid"]) && isset($_SESSION["username"]) && isset($_SESSION["password"])) {
$log_id = preg_replace('#[^0-9]#', '', $_SESSION['userid']);
$log_username = preg_replace('#[^a-z0-9]#i', '', $_SESSION['username']);
$log_password = preg_replace('#[^a-z0-9]#i', '', $_SESSION['password']);
// Verify the user
$user_ok = evalLoggedUser($db_conx,$log_id,$log_username,$log_password);
} else if(isset($_COOKIE["id"]) && isset($_COOKIE["user"]) && isset($_COOKIE["pass"])){
$_SESSION['userid'] = preg_replace('#[^0-9]#', '', $_COOKIE['id']);
    $_SESSION['username'] = preg_replace('#[^a-z0-9]#i', '', $_COOKIE['user']);
    $_SESSION['password'] = preg_replace('#[^a-z0-9]#i', '', $_COOKIE['pass']);
$log_id = $_SESSION['userid'];
$log_username = $_SESSION['username'];
$log_password = $_SESSION['password'];
// Verify the user
$user_ok = evalLoggedUser($db_conx,$log_id,$log_username,$log_password);
if($user_ok == true){
// Update their lastlogin datetime field
$sql = "UPDATE users SET lastlogin=now() WHERE id='$log_id' LIMIT 1";
        $query = mysqli_query($db_conx, $sql);
}
}
?>

当我们到达时

$db_id = $row[0];
$db_username = $row[1];
$db_pass_str = $row[2];

表结构必须按这个顺序吗？如

[ id | username | password ]

或者可以吗

[ id | email | username | password ]

如何输出变量以查看实际结果？

我已包含

$query = mysqli_query($db_conx, $sql);
$row = mysqli_fetch_row($query);
var_dump($row['username']);

我在哪里寻找输出？我被带到我的 message.php 页面，这意味着它会转到 user.php 页面，但不再允许输出显示在页面上

突破!!

好吧，我能够让它按照我的想法运行。问题是我必须手动更改电子邮件和密码才能使其正常工作。所以我想这是一个开始，可能意味着问题根本不在这里。也许在发布数据的区域内？ 关于可能出现的问题的任何想法或理论，以便我可以尝试解决它。​​

Answer 1

Mysql 或 PHP 不会神奇地插入字段。
我的猜测是您的数据库中有意外的数据。

我不擅长 PHP，但不应该能够执行 $row['username'] 吗？