[询问]PHP login的问题。。。劳烦大家 - JBTALKS.CC

<html>
<script>
@import url(design.css);
</script>
<head>
<title>Scholarship & Bursary - Home</title>
</head>
<script language="JavaScript">
function Login_Validate(theForm)
{
if(theForm.userid.value == "")
{
alert('Please enter the User ID');
theForm.id.focus();
return(false);
}
if(theForm.password.value == "")
{
alert('Please enter the Password');
theForm.password.focus();
return(false);
}
}
</script>
<body>
<table align="center">
<tr>
<td><img src="banner.jpg" alt="Southern College" width="1000" height="124"></td>
</tr>
<tr>
<td>
<script>
var mydate=new Date()
var year=mydate.getYear()
if (year < 1000)
year+=1900
var day=mydate.getDay()
var month=mydate.getMonth()
var daym=mydate.getDate()
if (daym<10)
daym="0"+daym
var dayarray=new Array("Sunday","Monday","Tuesday","Wednesday","Thursday","Friday","Saturday")
var montharray=new Array("January","February","March","April","May","June","July","August","September","October","November","December")
document.write("<small><font color='000000' face='Arial'><b>"+dayarray[day]+", "+montharray[month]+" "+daym+", "+year+"</b></font></small>")
</script>
<form action="login.php" name="loginForm" id="login" method="post" onsubmit="return Login_Validate(this)">
<table align="right" style="font-size:0.8em">
<tr>
<td>User ID: </td>
<td colspan="2"><input type="text" name="userid" id="userid" maxlength="11"/></td>
</tr>
<tr>
<td>Password: </td>
<td colspan="2"><input type="password" name="password" id="password" maxlength="8"/></td>
</tr>
<tr>
<td></td>
<td><input type="radio" name="lvl" id="student" value="student" checked="checked"/><label for="student">Student</label></td>
<td><input type="radio" name="lvl" id="staff" value="staff"/><label for="staff">Staff</label></td>
</tr>
<tr>
<td></td>
<td><input type="submit" name="submit" value="Login"/></td>
<td><input type="reset" name="submit" value="Clear"/></td>
</tr>
</table>
</form>
</td>
</tr>
<tr>
<td style="background-color:pink">
<a href="index.php" title="Home"><span>Home</span></a> |
<a href="register.php" title="Register"><span>Register</span></a>
</td>
<tr>
<td><hr/></td>
</tr>
</table>
</body>
</html>

复制代码

<?php
session_start();
include("connect.php");
if(isset($_POST["submit"]))
{
$id = $_POST["userid"];
$password = $_POST["password"];
$lvl = $_POST["lvl"];
if($id != "" && $password != "")
{
if($lvl = "staff")
{
$result = mysql_query("SELECT * FROM staff_user WHERE userID = '$id' AND password = '$password'");
if(mysql_num_rows($result) == 1)
{
$level = mysql_result($result, '0', 'staffLVL');
$_SESSION['userlvl'] = $level;
$_SESSION['userid'] = $id;
echo "<script>window.location='admin.php'</script>";
}
else
{
echo "<script>alert('Please check your USER ID and PASSWORD!')</script>";
echo "<script>window.location='admin.php'</script>";
}
}
else
{
$result = mysql_query("SELECT * FROM student_user WHERE userID = '$id' AND password = '$password'");
if(mysql_num_rows($result) == 1)
{
$_SESSION['userlvl'] = "Student";
$_SESSION['userid'] = $id;
echo "<script>window.location='applicant.php'</script>";
}
else
{
echo "<script>alert('Please check your USER ID and PASSWORD!')</script>";
echo "<script>window.location='index.php'</script>";
}
}
}
else
{
echo "<script>alert('Please check your USER ID and PASSWORD!')</script>";
echo "<script>window.location='index.php'</script>";
}
}
?>

复制代码

$result = mysql_query("SELECT * FROM staff_user WHERE userID = '$id' AND password = '$password'");
if(mysql_num_rows($result) == 1)
{
$level = mysql_result($result, '0', 'staffLVL');
$_SESSION['userlvl'] = $level;
$_SESSION['userid'] = $id;
echo "<script>window.location='admin.php'</script>";
}
else
{
echo "<script>alert('Please check your USER ID and PASSWORD!')</script>";
echo "<script>window.location='index.php'</script>";
}

复制代码

echo mysql_error();

复制代码

echo mysql_num_rows($result);

复制代码

if($id != "" & $password != "")

复制代码

if($lvl = "staff")

复制代码

if(mysql_num_rows($result) == 1)

复制代码

// 检查 POST 过来的资料是否成功POST 到。
// 应该 echo $id, echo $password 出来看看.
echo $id;
echo $password;
if($id != "" & $password != "")
{

复制代码

// 检查是否真的有这笔资料存在，然后你应该放 mysql_num_rows >= 1 , 酱也许就能避免你的 duplicate row 问题。
mysql_num_rows($result) >= 1

复制代码

$sql = "SELECT * FROM staff_user WHERE userID = '$id' LIMIT 1";
// 先找出符合 ID 条件的资料出来
$resourse = mysql_query($sql);
$rows = mysql_fetch_assoc($resourse);
if(mysql_num_rows($rows) > 0){
echo "record found " .$rows["password"] . " with id: ". $rows["userID"]; // debug 看看是不是有符合的资料出来。
if($rows["password"] == $password) // << select 出来了才来检查password.
header("Location: admin.php"); // match 到了, redirect 去 admin.php
}

复制代码