Wie aktualisiere ich mein PHP 4.0-Anmeldeskript auf PHP 5.6?

Question

mein Skript arbeitete unten perfekt auf PHP 4.0, aber mein ISP ein Upgrade auf PHP 5.6 und jetzt scheint es etwas falsch zu sein, jede Hilfe

Vielen Dank geschätzt

<?php 
$userdb="var1"; 
$pass="var2"; 
$database="var3"; 

mysql_connect("sql.servername.com",$userdb,$pass); 
@mysql_select_db($database) or die (header('location: status4.htm')); 
$match = "select id from USER_ACCOUNTS where username = '$username' and password = '$password'"; 
$qry = mysql_query($match) 
or die (header('location: status.htm?status=9')); 
$num_rows = mysql_num_rows($qry); 

// Valid Username and Password 
if ($num_rows > 0) { 
$qry = "SELECT * FROM USER_ACCOUNTS WHERE username like '%" . $username . "%'"; 
$res = mysql_query($qry); 
$output=''; 
while($row = mysql_fetch_assoc($res)){ 
// loop through all returned results 
$output .= '&viewUsername=' . $row['viewUsername'] . '&viewPassword=' . $row['viewPassword'] . '&username=' . $row['username'] . '&password=' . $row['password'] . '&name=' . $row['name'] . '&title=' . $row['title'] . '&email=' . $row['email'] . '&admin=' . $row['admin'] . '&file=' . $row['file'] . '&file2=' . $row['file2'] . '&file3=' . $row['file3'] . '&file4=' . $row['file4']; 
echo "&status=1"; 
echo $output; 
} 
} 
?> 

(es ist nicht zu mySQL, etc. stellt keine Verbindung)

Hier ist die mySQL 4.0 Tabelle

id viewUsername viewPassword username password name title email admin file file2 file3 file4 


1         user1  pass123  USER1 Manager email1 1  file1 file2 file3 file4 

Answer 1

Hier gehen Sie zB mit PDO-Anweisungen vorbereitet

<?php 

error_reporting(1); 
ini_set('display_errors', '1'); 

// mysql connection 
$db_host = 'localhost'; 
$db_user = 'root'; 
$db_pass = ''; 
$db_name = 'mydatabase'; 

$dbh = new PDO('mysql:host='.$db_host.';dbname='.$db_name.';charset=utf8', $db_user, $db_pass); 

// submit form 
if (isset($_POST['submit'])) 
{ 

    $username = $_POST['username']; 
    $password = $_POST['password']; 

    $stmt = $dbh->prepare("SELECT * FROM USER_ACCOUNTS WHERE username = :username AND password = :password"); 
    $stmt->bindParam(':username', $username); 
    $stmt->bindParam(':password', $password); 
    $stmt->execute(); 
    $number_of_rows = $stmt->fetchColumn(); 

    // Valid Username and Password 
    if ($number_of_rows > 0) 
    { 
     $row = $stmt->fetchAll(); 

     $output = ''; 

     while($row) 
     { 
      // loop through all returned results 
      $output .= '&viewUsername=' . $row['viewUsername'] . '&viewPassword=' . $row['viewPassword'] . '&username=' . $row['username'] . '&password=' . $row['password'] . '&name=' . $row['name'] . '&title=' . $row['title'] . '&email=' . $row['email'] . '&admin=' . $row['admin'] . '&file=' . $row['file'] . '&file2=' . $row['file2'] . '&file3=' . $row['file3'] . '&file4=' . $row['file4']; 
      echo "&status=1"; 
      echo $output; 
     } 
    } 

} 

?> 

und HTML-Formular

<form action="" method="post"> 
    <input type="text" name="username" placeholder="Username"><br /> 
    <input type="password" name="password" placeholder="Password"><br /> 
    <input type="submit" name="submit" value="Login"> 
</form> 

aktualisieren

<?php 

error_reporting(1); 
ini_set('display_errors', '1'); 

// mysql connection 
$db_host = 'localhost'; 
$db_user = 'root'; 
$db_pass = ''; 
$db_name = 'mydatabase'; 

$mysqli = new mysqli($db_host, $db_user, $db_pass, $db_name); 

/* check connection */ 
if (mysqli_connect_errno()) 
{ 
    echo "Connect failed: " . mysqli_connect_error(); 
    exit(); 
} 

// submit form 
if (isset($_POST['submit'])) 
{ 

    $username = $_POST['username']; 
    $password = $_POST['password']; 

    /* create a prepared statement */ 
    if ($stmt = $mysqli->prepare("SELECT * FROM USER_ACCOUNTS WHERE username = ? AND password = ?")) 
    { 
     /* bind parameters for markers */ 
     $stmt->bind_param("s", $username); 
     $stmt->bind_param("s", $password); 

     /* execute query */ 
     $stmt->execute(); 

     $number_of_rows = $stmt->rowCount(); 

     // Valid Username and Password 
     if ($number_of_rows > 0) 
     { 
      $row = $stmt->fetchAll(); 

      $output = ''; 

      while($row) 
      { 
       // loop through all returned results 
       $output .= '&viewUsername=' . $row['viewUsername'] . '&viewPassword=' . $row['viewPassword'] . '&username=' . $row['username'] . '&password=' . $row['password'] . '&name=' . $row['name'] . '&title=' . $row['title'] . '&email=' . $row['email'] . '&admin=' . $row['admin'] . '&file=' . $row['file'] . '&file2=' . $row['file2'] . '&file3=' . $row['file3'] . '&file4=' . $row['file4']; 
       echo "&status=1"; 
       echo $output; 
      } 
     } 

     /* close statement */ 
     $stmt->close(); 
    } 
} 
$mysqli->close(); 
?> 

Und versuchen, diese

<?php 

error_reporting(1); 
ini_set('display_errors', '1'); 


$conn = mysqli_connect('host', 'username', 'password', 'table name'); 

/* check connection */ 
if (mysqli_connect_errno()) 
{ 
    echo "Connect failed: " . mysqli_connect_error(); 
    exit(); 
} 

// submit form 
if (isset($_POST['submit'])) 
{ 

    $username = $_POST['username']; 
    $password = $_POST['password']; 

    $query = mysqli_query($conn, "SELECT * FROM USER_ACCOUNTS WHERE username = '$username' AND password = '$password'"); 

    if ($query) 
    { 
     // Valid Username and Password 
     if (mysqli_row_count($query) > 0) 
     { 
      $row = mysqli_fetch_array($query); 

      $output = ''; 

      while($row) 
      { 
       // loop through all returned results 
       $output .= '&viewUsername=' . $row['viewUsername'] . '&viewPassword=' . $row['viewPassword'] . '&username=' . $row['username'] . '&password=' . $row['password'] . '&name=' . $row['name'] . '&title=' . $row['title'] . '&email=' . $row['email'] . '&admin=' . $row['admin'] . '&file=' . $row['file'] . '&file2=' . $row['file2'] . '&file3=' . $row['file3'] . '&file4=' . $row['file4']; 
       echo "&status=1"; 
       echo $output; 
      } 
     } 
    } 
} 

?> 

Answer 2

ich würde vermuten, dass auf dem alten Version hatte man register_globals aktiviert, so dass in $username und $password Sie waren getti ng direkt, was von einem Formular gepostet wurde, was nicht mehr passiert.

Die schnelle Lösung würde zu Beginn des PHP-Code hinzuzufügen sein:

$username = $_REQUEST['username']; $password = $_REQUEST['password'];

aber sagen, dass schreit jede Zeile in Ihrem Code schlechte Praktiken und mögliche Schwachstellen. Ich würde Ihnen wärmstens empfehlen, Hilfe für eine komplette Überarbeitung zu bekommen, wenn Sie diese in einer produktiven Website verwenden.