实例演绎pdo在用户登录环节是怎么防sql注入的？

  1. $sql = 'SELECT `username`,`password` FROM `user` WHERE `username`= ? AND `password`=? ; ';//占位符来构成预处理语句
  2.     $stmt = $pdo->prepare( $sql );//准备要执行的预处理语句,并返回语句对象
  3.     $stmt->execute( [$username, $password] );//执行预处理语句
  4.     $res  = $stmt->fetch();
  5.     if ( $res )
  6.  {
  7.         //验证通过  存session
  8.         $_SESSION['username'] = $res['username'];
  10.         echo json_encode( array( 'status'=>1, 'msg'=>'登录成功...正在跳转' ), 320 );
  11.         exit;
  13.     }
  15.     echo json_encode( array( 'status'=>0, 'msg'=>'用户名或密码错误' ), 320 );

写一个小实战，实现预处理与会话跟踪？

一个前端页面显示文件,一个后端处理文件

后端文件实现预处理与会话跟踪

  1. <?php
  2. session_start();
  3. require 'config.php';
  5. $username = !empty( $_POST['username'] ) && isset( $_POST['username'] ) ? $_POST['username']:null;
  6. $password = !empty( $_POST['password'] ) && isset( $_POST['password'] ) ? md5( $_POST['password'] ):null;
  7. $code = !empty( $_POST['code_value'] ) && isset( $_POST['code_value'] ) ? $_POST['code_value'] :null;
  9. //请求分发器 type 1登录验证 2 验证码验证   3退出登录
  10. $type = isset( $_REQUEST['type'] ) && !empty( $_REQUEST['type'] ) ? intval( $_REQUEST['type'] ):null;
  12. switch( $type )
  13.  {
  14.     case 1:
  15.     //检测用户是否存在
  16.     $sql = 'SELECT `username`,`password` FROM `user` WHERE `username`= ? AND `password`=? ; ';
  17.     $stmt = $pdo->prepare( $sql );
  18.     $stmt->execute( [$username, $password] );
  19.     $res  = $stmt->fetch();
  20.     if ( $res )
  21.  {
  22.         //验证通过  存session
  23.         $_SESSION['username'] = $res['username'];
  25.         echo json_encode( array( 'status'=>1, 'msg'=>'登录成功...正在跳转' ), 320 );
  26.         exit;
  28.     }
  29.     echo json_encode( array( 'status'=>0, 'msg'=>'用户名或密码错误' ), 320 );
  30.     break;
  31.     case 2:
  32.     //将session中的验证码和用户提交的验证码进行核对, 当成功时提示验证码正确，并销毁之前的session值, 不成功则重新提交 strcasecmp
  33.     if ( !empty( $code ) && strtolower( $_SESSION['code'] ) === strtolower( $code ) ) {
  34.         $_SESSION['code'] = '';
  35.         echo json_encode( ['status'=>1, 'msg'=>'验证码正确'], 320 );
  36.         exit;
  37.     }
  38.     echo json_encode( ['status'=>0, 'msg'=>'验证码不正确'], 320 );
  39.     break;
  40.     // 退出登录
  41.     case 3:
  42.     // 清空session变量
  43.     session_unset();
  44.     // 删除session文件
  45.     session_destroy();
  47.     header( 'Location: /demo.php' );
  48.     break;
  49.     default:
  50.     echo json_encode( ['status'=>520, 'msg'=>'非法参数访问'], 320 );
  51.     break;
  52. }

前端页面

  1. <?session_start()?>
  2. <!DOCTYPE html>
  3. <html lang = 'en'>
  5. <head>
  6. <meta charset = 'utf-8' />
  7. <title>用户登录</title>
  8. <meta name = 'viewport' content = 'width=device-width, initial-scale=1.0' />
  9. <meta name = 'description' content = 'Premium Bootstrap 4 Landing Page Template' />
  10. <meta name = 'keywords' content = 'bootstrap 4, premium, marketing, multipurpose' />
  11. <meta content = 'Themesdesign' name = 'author' />
  13. <!-- css -->
  14. <link href = 'login/static/bootstrap.min.css' rel = 'stylesheet' type = 'text/css' />
  16. <!--Themify Icon -->
  17. <link href = 'login/static/style.css' rel = 'stylesheet' type = 'text/css' />
  18. </head>
  20. <body>
  22. <section class = 'bg-login d-flex align-items-center'>
  23. <div class = 'container'>
  24. <div class = 'row justify-content-center mt-4'>
  25. <div class = 'col-lg-4'>
  26. <nav>
  27. <?php if (!isset($_SESSION['username']) || empty($_SESSION['username'])): ?>
  28. <div class = 'bg-white p-4 rounded'>
  29. <div class = 'text-center'>
  30. <h4 class = 'fw-bold mb-3'>用户登录</h4>
  31. </div>
  32. <div class = 'row login-form'>
  33. <div class = 'col-lg-12 mt-2'>
  34. <input type="text" name="username" class = 'form-control' placeholder="用户名"   autofocus>
  35. </div>
  36. <div class = 'col-lg-12 mt-2'>
  37. <input type="password" name="password" class = 'form-control' placeholder="请输入密码"   >
  38. </div>
  39. <div class = 'col-lg-12 mt-2'>
  40. <input type = 'code' class = 'form-control' placeholder = '验证码' required = ''  name="code" id="code" style = 'float: left; width:55%;'>
  41. <label class = 'form-check-label'>
  42. <img src = 'login/code.php' onclick="this.src='login/code.php?id='+ Math.random();" height = '40px' style="margin: auto 10px;vertical-align: bottom; cursor:pointer" alt = '点击刷新'>
  43. </label>
  44. <span id="error_msg"> </span>
  45. </div>
  46. <div class = 'col-lg-12 mt-2'>
  47. <div class = 'form-check'>
  48. <input class = 'form-check-input' style = 'color: red;' type = 'checkbox' value = '' id = 'flexCheckDefault'>
  49. <label class = 'form-check-label' for = 'flexCheckDefault'>
  50. 记住
  51. </label>
  52. </div>
  53. </div>
  54. <div class = 'col-lg-12 mt-3 mb-4'>
  55. <button type ="button" class = 'btn btn-primary w-100' name="btn">登录</button>
  56. </div>
  57. <div class = 'txet-center'>
  58. <p class = 'mb-0 mt-2 text-center'>
  59. <a href = 'password_forget.html' class = 'text-dark fw-bold'>忘记密码 ?</a>
  60. </p>
  61. </div>
  62. </div>
  63. </div>
  64. <div class = 'text-center mt-3'>
  65. <p><small class = 'text-white mr-2'>未注册用户 ?</small> <a href = 'reg.html'
  67. class = 'text-white fw-bold'>创建账号</a></p>
  68. </div>
  69. <?php else : ?>
  70. <div class = 'text-center'>
  71. <h4 class = 'fw-bold mb-3'>您以成功登录</h4>
  72.             <a href="javascript:;"><?=$_SESSION['username']?></a>&nbsp;
  73.             <a href="login/login.php?type=3">退出</a>
  74.         </div>
  75.             <?php endif ?>
  76.         </nav>
  77. </div>
  78. </div>
  79. </div>
  80. </section>
  82. <!-- javascript -->
  84. <script type = 'text/javascript' src = "
  85. https://cdn.bootcss.com/jquery/3.3.1/jquery.min.js"></script>
  86. <script type="text/javascript">
  88. //登录
  89. $('button[name="btn"]').click(function(){
  90.     var data = {};
  91.     data.username =$.trim($('input[name="username"]').val()) ;
  92.     data.password = $.trim($('input[name="password"]').val());
  93.     data.type = 1;
  94.     var code = $.trim($('input[name="code"]').val())
  95.     if(data.username == '' || data.password == '' ||  code == '')
  96.     {
  97.         alert('必选项不能为空哦~');
  98.         return;
  99.     }
  100.     $.post('login/login.php',data,function(res){ 
  101.         if(res.status == 1)
  102.         {
  103.             alert(res.msg);
  104.             //用户验证通过 跳转首页
  105.             setTimeout(()=>location.href = 'demo.php',500);
  106.         }else{
  107.             alert(res.msg);
  108.         }
  109.     },"json")
  110. })
  113. //使用ajax异步验证 验证码
  114. $('input[name="code"]').keyup(function(){
  115.         var data={};
  116.         data.code_value = $.trim($(this).val());
  117.         data.type = 2;
  118.         if(data.code_value == '') 
  119.         {
  120.             $("#error_msg").html("<span style='color:green'>验证码不能为空</span>") 
  121.             return;
  122.         }
  123.         $.post('login/login.php',data,function(res){
  124.             if(res.status == 1)
  125.             {
  126.                 $("#error_msg").html("<span style='color:green'>验证码正确</span>")
  127.             }else{
  128.                 $("#error_msg").html("<span style='color:red'>验证码错误</span>")
  129.             }
  130.         },"json")
  131.     })
  132. </script>
  133. </body>
  135. </html>

更多相关文章

  1. 配置ssh远程登录sshd服务器
  2. 配置SSH密码登录
  3. php 登录注册
  4. PHP:【商城后台管理系统】部署管理员未登录拦截，进行重定向
  5. PHP:【商城后台管理系统】admin超级管理员后台登录界面部署
  6. 【RS】H3C设备 配置SSH登录
  7. mysql之pdo预处理与sql防注入
  8. 【PHP会话控制】理解会话控制cookie和session详解（附自动登录案例
  9. PHP:PDO预处理机制在防SQL注入的作用/PDO CURD预处理/PDO预处理

随机推荐

  1. android休眠运行
  2. Intent Server Environment
  3. android中获取SHA1的代码
  4. android 网络
  5. Android中声音处理流程
  6. android中重写onTouchEvent分别实现点击
  7. android渲染网页时onPageFinished不触发
  8. Android 自定义View 横向翻页
  9. Android圆环形自定义进度条控件的绘制
  10. Android软键盘弹出不影响布局的方法