<?php // var_dump($_GET['action']); var_dump($_POST); if ($_GET['action'] == 'login') { if($_POST['name']=='admin' && $_POST['pwd']==123456){ setcookie('username',$_POST['name'],time()+3600*24); header('Location:index.php'); } else { echo '<script> alert("您输入了错误的用户名或密码!");</script>'; } } elseif ($_GET['action']=='logout') { setcookie('name','',time()-3600);//注销cookie } ?> <!DOCTYPE html> <html> <head> <meta charset="UTF-8"> <title>用户登录</title> </head> <body> <form action="<?php echo $_SERVER['PHP_SELF']; ?>?action=login" method="post"> <fieldset> <legend>用户登陆:</legend> <label for="name">用户名:</label> <input type="text" name="name" id="name"/> <label for="pwd">密码:</label> <input type="password" name="pwd" id="pwd"/> <input type="submit" value="提交"> </fieldset> </form> </body> </html>
When admin 123 is entered, the following is displayed:
##When admin 123456 is entered, the error is reported as follows: My understanding is that since the wrong password can be passed the action value when clicking submit and entered into the first-level if statement for judgment, why can't the correct username and password be passed when submitting? The action value enters the first level if statement, and even the post value fails.
solved