[討論] 從外部檔案連接DB並分析帳號正確性的問題..

[holo1978]

不好意思，因為不曉得這問題要再哪發表，所以在非官方外掛PO出，
有不對的地方請見諒

以下是一個 由外界連結提供帳號與密碼，並連接到PhpBB資料庫進行比對，且回傳驗證結果 的一個程式。

假設輸入:
domain.com/login_get.php?user_name=test001&password=test
他會連到PhpBB資料庫，並且進行比對，並回傳一個數值(0-7)。

這程式碼結構本身是沒問題的，如果帳號是「英文」的話，都可以很正常回傳\r
但是如果是「中文」的帳號，就怎麼找都找不到？

因為小弟有另外一套系統，想與現有的PHPBB整合
所以想請教各位大大，有啥米辦法可以讓這個程式碼可以分析中文的帳號呢？
謝謝！


PhpBB版本：2.0.15
MySql: 4.0.7

代碼: 選擇全部

/* 檔名: login_get.php */

<?php

/**
 * please modify the database configuration
 */
$dbhost = "localhost";
$dbuser = "test_user";
$dbpasswd = "test001";
$dbname = "test_db";

$usertable = "phpbb_users";
$username_field = "username";
$password_field = "user_password";

// dbms - database type
// support dbms: mysql , mysql4 , db2, msaccess, mssql-odbc, oracle, postgres7
$dbms = "mysql4";


$phpEx = "php";
$lib_path = "./lib";


/**
 * Don't modify the code below unless you know what are you doing.
 */

// Define the output result
$LOGIN_SUCCESS = 0;
$LOGIN_PASSWD_ERROR = 1;
$LOGIN_NICK_EXIST = 2;
$LOGIN_ERROR = 3;
$LOGIN_ERROR_NOUSERID = 4;
$LOGIN_SUCCESS_ADMIN = 5;
$LOGIN_NOT_ALLOW_GUEST = 6;
$LOGIN_USER_BANED = 7;

switch($dbms)
{
	case 'mysql':
		include($lib_path . '/mysql.'.$phpEx);
		break;

	case 'mysql4':
		include($lib_path . '/mysql4.'.$phpEx);
		break;

	case 'postgres':
		include($lib_path . '/postgres7.'.$phpEx);
		break;

	case 'mssql':
		include($lib_path . '/mssql.'.$phpEx);
		break;

	case 'oracle':
		include($lib_path . '/oracle.'.$phpEx);
		break;

	case 'msaccess':
		include($lib_path . '/msaccess.'.$phpEx);
		break;

	case 'mssql-odbc':
		include($lib_path . '/mssql-odbc.'.$phpEx);
		break;
	default:
		echo $LOGIN_ERROR;
		exit;
}


// Make the database connection.
$db = new sql_db($dbhost, $dbuser, $dbpasswd, $dbname, false);
if(!$db->db_connect_id)
{
   echo $LOGIN_ERROR;
   exit;
}


$username = isset($HTTP_GET_VARS['username']) ? trim(htmlspecialchars($HTTP_GET_VARS['username'])) : '';
$username = substr(str_replace("\\\'", "'", $username), 0, 25);
$username = str_replace("'", "\\\'", $username);
$password = isset($HTTP_GET_VARS['password']) ? $HTTP_GET_VARS['password'] : '';
//$md5 = isset($HTTP_GET_VARS['md5']) ? $HTTP_GET_VARS['md5'] : ''; 

$sql = "SELECT " . $username_field ." , ". $password_field . "
	 FROM " . $usertable . "
	WHERE ". $username_field . " = '" . str_replace("\\\'", "''", $username) . "'";


if ( !($result = $db->sql_query($sql)) )
{
	echo $LOGIN_ERROR;
	exit;	
}

if( $row = $db->sql_fetchrow($result) )
{
	$db_user_password = $row[$password_field];

	if (($password == $db_user_password) || (md5($password) == $db_user_password))
	{
		echo $LOGIN_SUCCESS;
		exit;
	}
	else
	{	
		echo $LOGIN_PASSWD_ERROR;
		exit;
	}

}
else
{
	echo $LOGIN_ERROR_NOUSERID;
	exit;
}



?>