這里是初學者編碼器。我正在嘗試使用 html 和 php 構建一個非?；镜?php 登錄系統。但我需要一些幫助：<html><head></head><body> <form method="POST"> User <input type="text" name="user"></input><br/> Pass <input type="password" name="pass"></input><br/> <input type="submit" name="submit" value="Go"></input> </form> 和： <?php$user = $_POST['user'];$pass = $_POST['pass'];$passw= md5($pass);if ($user == "admin" && $passw == "8b1a9953c4611296a827abf8c47804d7") { echo "Login completed";} else { echo "Try Again Please";}?></body> </html>但是這里有些東西不太正常，當我輸入用戶名和密碼，然后單擊按鈕時，屏幕就像什么都沒發生一樣刷新。我錯過了什么？！
2 回答
慕桂英3389331
TA貢獻2036條經驗 獲得超8個贊
通常在登錄頁面上有一個輸入頁面，您可以在其中輸入您的憑據，即將變量提交到另一個站點。那么你必須有這樣的東西，在巫婆中你包括憑證形式。
<form method="post" action="https://example.com/landing_site.php">
<?php
include "credencial_html.php";
?>
</form>
credencial_html.php 看起來像這樣（簡單的 html 代碼）：
User <input type="text" name="user"><br/>
Pass <input type="password" name="pass"><br/>
<input type="submit" name="submit" value="Go">
現在你做了那個“如果”部分。...如果憑據正確，您可以發布，如果不正確，請再次輸入輸入框，然后說重試...
<?php
define('rightpass', '8b1a9953c4611296a827abf8c47804d7');
define('rightuser', '21232f297a57a5a743894a0e4a801fc3'); // md5('admin') ;-)
$user = md5($_POST['user']);
$pass = md5($_POST['pass']);
if ($user == rightuser && $pass == rightpass) {
echo "Login completed";
} else {
echo "Try Again Please";
include "credencial_html.php";
}
?>
梵蒂岡之花
TA貢獻1900條經驗 獲得超5個贊
基本，我認為您的意思是不合邏輯且不安全。放松，我只是讓你很難受。您應該加密您的密碼（可能是 SHA2）并將它們存儲在數據庫中。我猜你想使用MySQL。
步驟1
創建兩個數據庫。一個用于您的加密密鑰，一個用于您的用戶名和密碼。您應該可以通過某種控制面板(cPanel)來做到這一點。
第2步
創建一個安全restricted文件夾（權限 100）并將文件（權限 400）放入該文件夾中https.php。connect.phprestricted
<?php /* restricted/https.php */
if(!isset($_SERVER['HTTPS'])){
header("LOCATION:https://{$_SERVER['SERVER_NAME']}{$_SERVER['PHP_SELF']}"); die;
}
?>
和
<?php /* restricted/connect.php */
$kb = new mysqli('keyHost', 'keyDatabaseUsername', 'keyDatabasePassword', 'keyDatabaseName');
$db = new mysqli('userHost', 'userDatabaseUsername', 'userDatebasePassword', 'userDatabaseName');
?>
當然，您需要使用正確的'host', 'username', 'password','database'名稱。
步驟#3
創建兩個表。一個用于您的加密密鑰，一個用于您的密碼。此時我將使用 PHP 來創建 MySQL。我們稱這個文件pass_create.php 為（權限 400）。也放到restricted文件夾里。
<?php /* restricted/pass_create.php */
require_once 'https.php'; require_once 'connect.php';
if(!$kb || $!db)die('connection failure');
$kb->query('CREATE TABLE passkeys(
user TINYTEXT NOT NULL,
pass TINYTEXT NOT NULL
)ENGINE=InnoDB');
$keyStatement = $kb->prepare('INSERT passkeys VALUES (?, ?)');
$keyStatement->bind_param('ss', 'iYa9Ab%5@3m', 'w*Fu4m^Ga92'); $keyStamement->execute();
$db->query('CREATE TABLE passes(
id BIGINT UNSIGNED AUTO_INCREMENT, PRIMARY KEY(id),
user TINYBLOB NOT NULL,
pass TINYBLOB NOT NULL
)ENGINE=InnoDB');
// normally you would do the new password inserts dynamically with AJAX - just an example
$keyResult = $kb->query('SELECT user, pass FROM passkeys');
$keyObj = $keyResult->fetch_object(); $userKey = $keyObj->user; $passKey = $keyObj->pass;
$keyResult->free();
$createPassStatement = $db->prepare('INSERT passes (user, pass) VALUES(DES_ENCRYPT(?, ?), DES_ENCRYPT(SHA2(?), ?))');
$createPassStatement->bind_param('ssss', 'usernameHere', $userKey, 'passwordHere', $passKey);
$createPassStatement->execute(); $kb->close(); $db->close();
?>
在 中創建并執行一個temp.php頁面。在瀏覽器中運行文件，然后將其刪除。更改為。_ 在on之后直接輸入并重新保存它，或者干脆完全刪除該頁面。<? require_once 'restricted/https.php'; require_once 'restricted/pass_create.php'; ?>htdocstemp.php$keyStatement->bind_param('ss', 'iYa9Ab%5@3m', 'w*Fu4m^Ga92')restricted/pass_create.php$keyStatement->bind_param('ss', '', '')die('hacker');<?phprestricted/pass_create.php
第4步
創建一個js文件夾（權限 100）來保存您的 JavaScript 文件和一個小型庫，以便將數據發送到服務器（見下文）。我們將調用該文件external.js (Permission 444)。放入external.js你的js文件夾。
//<![CDATA[
/* js/external.js */
var get, post, doc, html, bod, nav, mobile, M, I, S, Q, aC, rC, special, unspecial; // for use on other loads
addEventListener('load', function(){
get = function(url, success, context){
var x = new XMLHttpRequest;
var c = context || this;
x.open('GET', url);
x.onload = function(){
if(success)success.call(c, JSON.parse(x.responseText));
}
x.send();
}
post = function(url, send, success, context){
var x = new XMLHttpRequest;
var c = context || this;
x.open('POST', url);
x.onload = function(){
if(success)success.call(c, JSON.parse(x.responseText));
}
if(typeof send === 'object' && send && !(send instanceof Array)){
if(typeof FormData !== 'undefined' && send instanceof FormData){
x.send(send);
}
else{
var s, r = [];
for(var p in send){
s = send[p];
if(typeof s === 'object')s = JSON.stringify(s);
r.push(encodeURIComponent(p)+'='+encodeURIComponent(s));
}
x.setRequestHeader('Content-type', 'application/x-www-form-urlencoded'); x.send(r.join('&'));
}
}
else{
throw new Error('send argument must be an Object');
}
return x;
}
doc = document; html = doc.documentElement; bod = doc.body; nav = navigator;
mobile = nav.userAgent.match(/Mobi/i) ? true : false;
M = function(tag){
return doc.createElement(tag);
}
I = function(id){
return doc.getElementById(id);
}
S = function(selector, within){
var w = within || doc;
return w.querySelector(selector);
}
Q = function(selector, within){
var w = within || doc;
return w.querySelectorAll(selector);
}
aC = function(element, className, yFunc){
var s = element.className.split(/\s+/), n = s.indexOf(className);
if(n === -1){
s.push(className); element.className = s.join(' ').trim();
if(yFunc)yFunc(element);
}
return function(className, yFunc){
return aC(element, className, yFunc);
}
}
rC = function(element, className, yFunc){
var s = element.className.split(/\s+/), n = s.indexOf(className);
if(n !== -1){
s.splice(n, 1); element.className = s.join(' ').trim();
if(yFunc)yFunc(element);
}
return function(className, yFunc){
return rC(element, className, yFunc);
}
}
special = function(str){
return str.replace(/&/g, '&').replace(/'/g, ''').replace(/"/g, '"').replace(/</g, '<').replace(/>/g, '>');
}
unspecial = function(str){
return str.replace(/&/g, '&').replace(/'/g, "'").replace(/"/g, '"').replace(/</g, '<').replace(/>/g, '>');
}
}); // end load
//]]>
步驟#5
創建一個css和login文件夾（權限均為 100）。在您的文件夾中放置一個名為external.css (Permission 444)的css文件。在您的文件夾中放置一個名為index.php (Permission 444)login的 html 頁面。請看下面的代碼：
/* css/external.css */
*{
box-sizing:border-box;
}
html,body{
padding:0; margin:0; width:100%; height:100%;
}
#logon{
background:#ccc; padding:5px 7px;
}
label{
display:inline-block; font-size:24px; width:100%;
}
input{
width:100%; font-size:24px; padding:3px 5px; margin-bottom:7px; border:1px solid #d00;
}
.yes{
border-color:#0a0;
}
#login{
background:linear-gradient(#0a0, #070); color:#fff; border-radius:5px; margin-top:7px;
padding:5px 0;
}
.error{
color:#a00; text-align:center; padding-bottom:5px;
}
.hide{
display:none;
}
<?php /* login/index.php */ require_once '../restricted/https.php'; ?>
<!DOCTYPE html>
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en'>
<head>
<meta charset='UTF-8' /><meta name='viewport' content='width=device-width, height=device-height, initial-scale:1, user-scalable=no' />
<title>Title Here</title>
<link type='text/css' rel='stylesheet' href='css/external.css' />
<script src='../js/external.js'></script>
<script src='../js/login.js'></script>
</head>
<body>
<div class='main'>
<div id='logon'>
<label for='user'>Username</label>
<input id='user' type='text' maxlength='64' />
<label for='pass'>Password</label>
<input id='pass' type='password' maxlength='64' />
<input id='login' type='button' value='LOGIN' />
<div id='login_error' class='error'>Username and Password Required</div>
</div>
</div>
</body>
</html>
步驟#6
在您已創建的同一文件夾中創建一個名為login.js (Permission 444)的文件。js
//<![CDATA[
/* ..js/login.js - up a level because we're in the login folder - requires ..js/external.js */
addEventListener('load', function(){
var user = I('user'), pass = I('pass'), login = I('login'), error = I('login_error');
function emptyTests(){
var uv = user.value, pv = pass.value;
if(uv.value === ''){
if(pv.value === ''){
rC(pv, 'yes'); error.innerHTML = 'Username & Password Required';
}
else{
aC(pv, 'yes'); error.innerHTML = 'Username Required';
}
rC(uv, 'yes'); rC(login, 'yes'); rC(error, 'hide'); // remove error and hide classes
}
else if(pv.value === ''){
aC(uv, 'yes'); rC(pv, 'yes'); rC(login, 'yes'); error.innerHTML = 'Password Required';
rC(error, 'hide');
}
else{
aC(uv, 'yes'); aC(pv, 'yes'); aC(login, 'yes'); aC(error, 'hide'); // no require error - hide error class
return true;
}
return false;
}
function logTest(){
if(emptyTests()){
var fd = new FormData;
fd.append('pepper', 'lim7it8!#WTF'); fd.append(user, user.value);
fd.append(pass, pass.value);
post('login.php', fd, function(r){
var o = JSON.parse(r);
if(o && o.good){
location = 'login_success.php';
}
else{
// don't give username password details
error.innerHTML = 'Login Error'; rC(user, 'yes'); rC(pass, 'yes');
rC(login, 'yes'); rC(error, 'hide');
});
}
}
user.onkeyup = pass.onkeyup = function(e){
if(e.key === 'Enter'){
logTest();
}
else{
emptyTests();
}
}
login.onclick = logTest;
}); // end load
//]]>
步驟 #7
創建一個index.php文件（權限 444）并將其放入login您已經創建的文件夾中：
<?php
session_start(); // send before headers
require_once '../restricted/https.php'; $o = new StdClass; $o->good = false;
if(isset($_POST['pepper'], $_POST['user'], $_POST['pass']) && $_POST['pepper'] === 'lim7it8!#WTF' && strlen($_POST['user']) < 65 && strlen($_POST['pass']) < 65){ // limit and test for submission
require_once '../restricted/connect.php';
$user = $_POST['user']; $pass = $_POST['user']; $o = new StdClass;
$keyRes = $kb->query('SELECT user, pass FROM passkeys'); $keyObj = $keyRes->fetch_object();
$userKey = $keyObj->user; $passKey = $keyObj->pass; $keyRes->free(); $kb->close();
$logStmt = $db->prepare("SELECT 'good' FROM passes WHERE user=DES_ENCRYPT(?, ?) && pass=DES_ENCRYPT(SHA2(?), ?)");
$logStmt->bind_param('ssss', $user, $userKey, $pass, $passKey); $logStmt->execute();
$logStmt->bind_result($yes);
if($logStmt->fetch() && $yes === 'good'){
$o->good = true; $_SESSION['login'] = 'can!B4Hard2?';
}
$logStmt->free(); $db->close();
echo json_encode($o);
}
else{
echo json_encode($o);
die('hacker');
}
步驟 #8
在您的文件夾中創建您的login_success.php （許可 444）htdocs：
<?php /* login_success.php - you should really call this what you want - just make sure the location in the JavaScript AJAX is the same */
session_start(); // before headers
require_once 'restricted/https.php';
if(!isset($_SESSION['login']) || $_SESSION['login'] !== 'can!B4Hard2?')die('hacker');
?>
<!-- now create your other html page -->
現在您可以告訴您的用戶登錄yourdomain/login!!! 確保你服務結束https。而且...是的，我知道其中一些步驟實際上是多個步驟。它們實際上只是供您提問的參考。
- 2 回答
- 0 關注
- 122 瀏覽
添加回答
舉報
0/150
提交
取消