登录表单使用任何密码登录任何用户

Question

我使用php和ibm db2来创建简单的登录页面。但是，代码没有按预期提供所需的结果。

这是我的代码：

if (isset($_POST['login'])) {
$username = ($_POST['username']);
$password = ($_POST['password']);

if (empty($username)) {
    array_push($errors, "Username is required");
}
if (empty($password)) {
    array_push($errors, "Password is required");
}

elseif (count($errors)==0) {
    //$password = md5($password);

    $query = "SELECT * FROM people WHERE username = '$username' AND password = '$password'";
    $results = db2_exec($db, $query);

    if (db2_num_rows($results)) {

        $_SESSION['username'] = $username;
        $_SESSION['success'] = "Logged in successfully";
        //echo "<script type='text/javascript'>window.location.href = 'index.php';</script>";
        header('Refresh: 0; URL=index.php', true, 301);
    }else{
        array_push($errors, "Wrong username/password combination, Please try again.");
    }
}

}

Answer 1

您不能使用db2_num_rows（）来获取结果集中的行数。

db2_num_rows()报告受最近插入/更新/删除语句影响的插入/更新/删除行的数量。

如果要在结果集中检查至少一行，请使用结果集中的一个documented methods to fetch a row。如果存在行，这些函数将返回true，否则在没有行或没有行时返回false。

考虑按照示例使用预准备语句，以便查询只编译一次并执行多次。

Answer 2

查询现在解决了，谢谢大家！我在这里发布运行代码;

if (isset($_POST['login'])) {
$username = ($_POST['username']);
$password = ($_POST['password']);

if (empty($username)) {
    array_push($errors, "Username is required");
}
if (empty($password)) {
    array_push($errors, "Password is required");
}

elseif (count($errors)==0) {
    $password = md5($password);

    $query = "SELECT * FROM people WHERE username = '$username' AND password = '$password'";
    $results = db2_exec($db, $query);

    $row = db2_fetch_assoc($results);

    if ($row['username']== $username && $row['password'] == $password) {

        $_SESSION['username'] = $username;
        $_SESSION['success'] = "Logged in successfully";

        header('Refresh: 0; URL=index.php', true, 301);
    }else{
        array_push($errors, "Wrong username/password combination, Please try again.");
    }
}

}