Question

This question already has answers here:

Possible Duplicate:
Getting MYSQL ERROR from my site

我主办了一个bux网站 ClimsonBux.com.Com. 所有事情都与剧本合作极好。我对密码检索页面 < a href="http://crimsonbux.com/login.php?option=forgot" rel="nofolt noreferr" >http://crimsonbux.com/login.php?option=forgot 。在进入电子邮件地址和页面CAPTCHA后,用户被重新定位到这个页面 < a href="http://crimsonbux.com/recover.php" rel=“nofollown noreferr"> >http://crimsonbux.com/recover.php 。在检索.php页面用户面临错误。错误如下:

Warning: mysql_query() [function.mysql-query]: Access denied for user  crimst1d @ localhost  (using password: NO) in /home/crimst1d/public_html/recover.php on line 19

Warning: mysql_query() [function.mysql-query]: A link to the server could not be established in /home/crimst1d/public_html/recover.php on line 19

在这里,我的网站无法连接到 MySQL 数据库。如何连接?

以下是我对恢复.php页面的配置。

<?
/**********************************************************************************************************************************************
    ScriptBux Version 2.50 beta
    This Script has been created and coded by Gabrola and edited by hassan ahmady.
    If you find any bugs in the script report at [email protected] or contact hassan ahmady.
    Copywrite ScriptBux 2008;
    Please make donations if you use this sript for commercial use
    to My paypal account "[email protected]"
************************************************************************************************************************************************/

?>

<h3>Forgot Password</h3>
<?php
if($_POST)
{
  $code = $_POST["code"];
  $email = $_POST["email"];
  $emailx = mysql_query("SELECT COUNT(*) AS cnt FROM tb_users WHERE email= {$_POST[ email ]} ");
  $emailx = mysql_fetch_array($emailx);
  $emailx = $emailx["cnt"];
  $errormsg = false;
  if($_SESSION[ string ] != $code)
  {
    $error = 1;
    $errormsg .= "<b>Error -</b> The captcha was entered incorrectly.<br />";
  }
  if(!$code)
  {
    $error = 1;
    $errormsg .= "<b>Error -</b> The captcha was entered incorrectly.<br />";
  }
  if(!$email)
  {
    $error = 1;
    $errormsg .= "<b>Error -</b> The email was not supplied.<br />";
  }
  if(!$emailx)
  {
    $error = 1;
    $errormsg .= "<b>Error -</b> No account was found with that email address.<br />";
  }
  if($_SESSION[ next_reseptsend ] != 0)
  {
    $error = 1;
    $errormsg .= "<b>Error -</b> You have already made a password retrieval within the last 15 minutes.<br />";
  }
  $_SESSION[ string ] = false;
  if($error)
  {
    print $errormsg."<br><br>";
  } else {
    $s = mysql_query("SELECT * FROM tb_users WHERE email= {$_POST[ email ]} ");
    $x = mysql_fetch_array($s);
    $_SESSION[ next_reseptsend ] = 1;
    $message = "Hello {$x[ username ]},
    You requested to resend your account password a while ago.

    Account Username: {$x[ username ]}
    Account Password: {$x[ password ]}

    We hope you can have a good time earning your money again,

    Thanks,
    {$config[ site_name ]}";
    mail($x["email"],"Password Retrieval - ".$config["site_name"],$message,"From: mail@".$_SERVER[ HTTP_HOST ]);
    print "<b>Password Sent!</b><br />
    We have dispatched your password to your email address.<br />
    You can only make another account retrieval again in 15 minutes.<br />";
  }
}
?>

<div style="padding-left:25px;">
<form action="recover.php" method="post" name="resend">
<table>
<tr><td class="midtext">Your Email:</td><td><input type="text" name="email" size="25" class="form" autocomplete="off" value="<?=$_POST[ email ]?>"></td></tr>
<tr><td class="midtext" valign="top">Security Code:</td><td class="midtext"><img src="image.php" onclick="this.src= image.php?newtime=  + (new Date()).getTime();"><br /><span style="font-size:10px;">(Click to reload)</span><br /><input type="text" name="code" size="17" maxlength="" autocomplete="off" class="form"></td></tr>
<tr><td></td><td align="right"><input type="submit" value="Login" name="loginsubmit"  class="inputbox"></td></tr>
</table>
</form>
</div>

<?php

?>

Answer 1

您需要将一个用户添加到您的数据库中, 以及您脚本可以通过 < a href=" http:// php. net/ manual/ en/ complice. mysql- connect.php" rel= “nofolp” {code> mysql_ 连接和 < a href=" http://php. net/ manual/ en/ comple.mysql- select- db.php" rel="nofolpol"\\ code>mysql_select_ db 连接到数据库中。

在脚本顶部的位置 :

mysql_connect( localhost ,  username ,  password );
mysql_select_db( database name );

Answer 2

在此选择如何解决您的安全漏洞。更改此选项 :

$emailx = mysql_query("SELECT COUNT(*) AS cnt FROM tb_users WHERE email= {$_POST[ email ]} ");

与此相关的:

$emailUntainted = mysql_real_escape_string($_POST[ email ]);
$emailx = mysql_query("
    SELECT COUNT(*) AS cnt
    FROM tb_users
    WHERE email= {$emailUntainted} 
");

您有两个需要修正的选项; 也做一些读取, 以便 理解为何有必要这样做 < code> : 。

文章脚本 : 如 @ Esailija 所说, 最好使用 PDO 和 准备的语句 , 但这需要您更多学习。快速获取此修正, 然后在可以时切换到 PDO 。

友情链接