Php-双向登录表单[管理员和用户]

我正在尝试建立一个登录表单，它能够检测用户是管理员还是非管理员。我尝试了以下操作，但运行时没有结果：

<?php

    session_start();
    $message = "";

    if(count($_POST)>0)
    {
        $conn = ($GLOBALS["___mysqli_ston"] = mysqli_connect("localhost", "prosoftl_rcc", "Royal"));

        ((bool)mysqli_query($conn, "USE prosoftl_rcc"));

        $result = mysqli_query($GLOBALS["___mysqli_ston"], "SELECT * FROM student WHERE name='" . $_POST["user_name"] . "' and password = '". $_POST["password"]."'");
        $row  = mysqli_fetch_array($result);

        $a = mysqli_query($GLOBALS["___mysqli_ston"], "SELECT * FROM teacher WHERE name='" . $_POST["user_name"] . "' and password = '". $_POST["password"]."'");
        $r = mysqli_fetch_array($a);

        if(is_array($row))
        {
            $_SESSION["id"] = $row[id];
            $_SESSION["name"] = $row[name];
        }
        elseif(is_array($r))
        {
            $_SESSION["admin"] = $row[id];
        }
        else
        {
            $message = "Invalid Username or Password!";
        }
    }
    if(isset($_SESSION["id"]))
    {
        header("Location:user_dashboard.php");
    }
    elseif(isset($_SESSION["admin"]))
    {
        header ("location:gui-admin.php");
    }

?>

当我为admin插入用户名和密码时，它会重新加载登录表单

更新1：

---

非管理员部分工作正常，但管理员部分将自己重定向/重新加载到登录表单。

您应该检查您的登录帖子表单，应该有如下代码：

<form name="loginform" method="post" action="check.php">

如果您的“操作”无效，页面可能会刷新

---

您应该确认您的登录表单已发布到您发布的php页面。

试试这个，让我们看看会发生什么

session_start();
$msg = "";
if(count($_POST)>0){
 $conn = ($GLOBALS["___mysqli_ston"] = mysqli_connect("localhost", "prosoftl_rcc", "Royal"));

    ((bool)mysqli_query($conn, "USE prosoftl_rcc"));

    $result = mysqli_query($GLOBALS["___mysqli_ston"], "SELECT * FROM student WHERE name='" . $_POST["user_name"] . "' and password = '". $_POST["password"]."'");
    $stdCount  = mysqli_num_rows($result);//counts the number or rows returned from student table
    $a = mysqli_query($GLOBALS["___mysqli_ston"], "SELECT * FROM teacher WHERE name='" . $_POST["user_name"] . "' and password = '". $_POST["password"]."'");
    $tchrCount = mysqli_num_rows($a);// same but with teachers table
    if($stdCount != 0){
       $row = mysql_fetch_array($result);
       $_SESSION['id'] = $row['id']; //set session for non admin.
   }else if($tchrCount != 0){
      $r = mysql_fetch_array($a);
      $_SESSION['admin'] = $r['id'];
  }else{
         echo "Username and Password is not Matching.";
  }
 }//end of the main if

我还没有测试过这段代码，所以不知道它是否有效，但我认为你已经掌握了逻辑

使用引号：$row[id] 地点：必须是首都。 调用header函数后，请确保使用exit。 这段代码没有经过测试，但如果我理解正确，应该可以工作

---

希望它能有所帮助……

但我可以猜出为什么您的代码只为学生工作而面临问题。 在本条中—

if(is_array($row))

is_array$row将始终返回true，代码将继续执行

$_SESSION["id"] = $row[id];
$_SESSION["name"] = $row[name];

但是$row[id]将为空，因为没有与条件匹配的行，因此不会分配$U会话[id]，并且在执行此操作时-

if(isset($_SESSION["id"]))
    {
        header("Location:user_dashboard.php");
    }
    elseif(isset($_SESSION["admin"]))
    {
        header ("location:gui-admin.php");
    }

由于未设置任何if语句，因此不会执行任何if语句。这是我的分析。这可能是错误的

尝试下面的解决方案-

您应该合并用户表，以便仅查询用户是学生还是教师。然后根据主用户表查询学生表或教师表。在两个表中查询相同的用户名和密码看起来不太好

您可以将我代码中的meta标记更改为headerLocation:$url，但我更喜欢这样，这样用户就不会缓存请求。 希望有帮助：-

$sql="SELECT * FROM {$table} WHERE username='{$username}' and password='{$password}'"; //My variables are already filtered and safe from SQL Injection. 

$result=mysqli_query($mysqli, $sql);

if(mysqli_num_rows($result))
{
    $fetch=mysqli_fetch_row($result);
    $_SESSION["id"]=$fetch['userid'];//Just fetching all details
    $_SESSION["Name"]=$fetch['name'];//and making session variables for that.
    $_SESSION["username"]=$fetch['username'];
    $isadmin=$fetch['isadmin']; //is a BOOL value in MySQL table.

        if($isadmin) //checking whether admin or not
        {
            $_SESSION["isadmin"]=1;
            echo "<meta http-equiv='refresh' content='0;url=adminurl'>";    } //if admin redirect to different url
        else{
            $_SESSION["isadmin"]=0;
            echo "<meta http-equiv='refresh' content='0;url=userurl'>";         
        }
}
else
{
    //Username Password Incorrect
    /* Show FORM HERE */
}

---

首先，您必须知道，在SQL请求中直接使用POST数据确实是个坏主意，您必须避免这种情况，并使用类似的函数清理数据。此外，您必须保护您的密码，并避免将其清楚地保存到数据库中，为此，请查看

对于您的两个SQL请求，您可以像我在本例中一样使用，在本例中，我使用相同的脚本获取POST数据并显示登录表单：

<?php

if(count($_POST) > 0){

    session_start();

    $link = mysqli_connect('localhost', 'user', 'pass', 'db');

    if(mysqli_connect_errno()) {
        die('db connection error : ' . mysqli_connect_error());
    }

    function secure_password($password){
        // secure your password here
        return $password;
    }

    // escape special characters
    $user_name = mysqli_real_escape_string($link, $_POST['user_name']);
    // you have to secure your passwords, when saving it of course
    $password = secure_password(mysqli_real_escape_string($link, $_POST['password']));

    $query  = "SELECT id FROM student WHERE name = '".$user_name."' and password = '".$password."';";
    $query .= "SELECT id FROM teacher WHERE name = '".$user_name."' and password = '".$password."'";

    $is_teacher = FALSE;

    if(count($_SESSION)) session_destroy();

    // you can use mysqli_multi_query for your two requests
    if (mysqli_multi_query($link, $query)) {
        do {
            if ($result = mysqli_store_result($link)) {
                if ($row = mysqli_fetch_row($result)) {
                    if($is_teacher){
                        $_SESSION['admin'] = $row[0];
                    } else {
                        $_SESSION['id'] = $row[0];
                        $_SESSION['name'] = $user_name;
                    }
                }
                mysqli_free_result($result);
            }
            if (mysqli_more_results($link)) {
                // if we have more results, so it's a teacher record
                $is_teacher = TRUE;
            }
        } while (mysqli_more_results($link) && mysqli_next_result($link));
    }
    mysqli_close($link);

    if(isset($_SESSION['id']))
    {
        header('Location:user_dashboard.php');
    }
    elseif(isset($_SESSION['admin']))
    {
        header('Location:gui-admin.php');
    }

    // no redirection, show the message and the login form
    echo 'Invalid Username or Password!';    

} 

?>
<form action='p.php' method='post'>
    User name : <input type='text' name='user_name'><br>
    Password : <input type='password' name='password'><br>
    <input type='submit' value='Submit'>
</form> 

---

希望能有所帮助。

条件语句是错误的，否则请使用else@CodingHorror对不起，先生，我没有告诉您，还有两个要删除的其他字段使用行计数检查输入值存在于哪个表上。$row[id]和$row[name]，syntex错误-缺少引号，应该是$row[name]，@CodingHorror非管理员部分在没有引用的情况下工作正常亲爱的先生，非管理员用户部分正在工作，因此操作值不会出错

<?php

if(count($_POST) > 0){

    session_start();

    $link = mysqli_connect('localhost', 'user', 'pass', 'db');

    if(mysqli_connect_errno()) {
        die('db connection error : ' . mysqli_connect_error());
    }

    function secure_password($password){
        // secure your password here
        return $password;
    }

    // escape special characters
    $user_name = mysqli_real_escape_string($link, $_POST['user_name']);
    // you have to secure your passwords, when saving it of course
    $password = secure_password(mysqli_real_escape_string($link, $_POST['password']));

    $query  = "SELECT id FROM student WHERE name = '".$user_name."' and password = '".$password."';";
    $query .= "SELECT id FROM teacher WHERE name = '".$user_name."' and password = '".$password."'";

    $is_teacher = FALSE;

    if(count($_SESSION)) session_destroy();

    // you can use mysqli_multi_query for your two requests
    if (mysqli_multi_query($link, $query)) {
        do {
            if ($result = mysqli_store_result($link)) {
                if ($row = mysqli_fetch_row($result)) {
                    if($is_teacher){
                        $_SESSION['admin'] = $row[0];
                    } else {
                        $_SESSION['id'] = $row[0];
                        $_SESSION['name'] = $user_name;
                    }
                }
                mysqli_free_result($result);
            }
            if (mysqli_more_results($link)) {
                // if we have more results, so it's a teacher record
                $is_teacher = TRUE;
            }
        } while (mysqli_more_results($link) && mysqli_next_result($link));
    }
    mysqli_close($link);

    if(isset($_SESSION['id']))
    {
        header('Location:user_dashboard.php');
    }
    elseif(isset($_SESSION['admin']))
    {
        header('Location:gui-admin.php');
    }

    // no redirection, show the message and the login form
    echo 'Invalid Username or Password!';    

} 

?>
<form action='p.php' method='post'>
    User name : <input type='text' name='user_name'><br>
    Password : <input type='password' name='password'><br>
    <input type='submit' value='Submit'>
</form>