注册功能无法写入数据库记录，密码匹配逻辑异常求助

问题描述 #

开发数据库注册功能时，无法将用户信息写入数据库。浏览器控制台无报错，但signup.php中密码明明匹配，却进入else分支，提示“密码不匹配”。

现有代码 #

后端signup.php代码 #

<?php
    
$showAlert = false;
$showError = false;
$exists=false;
    
if($_SERVER["REQUEST_METHOD"] == "POST") {
    
    // 引入数据库连接文件
    include 'db_config.php';
    
    $username = $_POST["username"];
    $password = $_POST["password"];
    $cpassword = $_POST["cpassword"];
            
    
    $sql = "Select * from signup where username='$username'";
    
    $result = mysqli_query($conn, $sql);
    
    $num = mysqli_num_rows($result);
    
    // 检查用户名是否已存在
    if($num == 0) {
        if(($password == $cpassword) && $exists==false) {
    
            $hash = password_hash($password,
                                PASSWORD_DEFAULT);
                
            // 插入用户数据
            $sql = "INSERT INTO `signup` ( `username`,
                `password`, `date`) VALUES ('$username',
                '$hash', current_timestamp())";
    
            $result = mysqli_query($conn, $sql);
    
            if ($result) {
                $showAlert = true;
            }
        }
        else {
            $showError = "Passwords do not match";
        }   
    }// end if
    
if($num>0)
{
    $exists="Username not available";
}
    
}//end if
    
?>

<?php
    
    if($showAlert) {
    
        echo ' <div class="alert alert-success 
            alert-dismissible fade show" role="alert">
    
            Success! Your account is 
            now created and you can login. 
            <button type="button" class="close"
                data-dismiss="alert" aria-label="Close"> 
                <span aria-hidden="true">×</span> 
            </button> 
        </div> '; 
    }
    
    if($showError) {
    
        echo ' <div class="alert alert-danger 
            alert-dismissible fade show" role="alert"> 
        Error! '. $showError.'
    
       <button type="button" class="close" 
            data-dismiss="alert aria-label="Close">
            <span aria-hidden="true">×</span> 
       </button> 
     </div> '; 
   }
        
    if($exists) {
        echo ' <div class="alert alert-danger 
            alert-dismissible fade show" role="alert">
    
        Error! '. $exists.'
        <button type="button" class="close" 
            data-dismiss="alert" aria-label="Close"> 
            <span aria-hidden="true">×</span> 
        </button>
       </div> '; 
     }
   
?>

前端表单代码（原不完整版本） #

<!-- 使用Bootstrap的前端表单 -->
<form action="signup.php" method="post" class="relative z-5  wow fadeInUp">
    <div class="form-group relative mb-25 mb-sm-20">
        <input type="text" class="form-control input-lg input-white shadow-5" id="username" placeholder="Username" name="username" required>
        <i class="far fa-user transform-v-center"></i>
    </div>
    <!-- 原代码缺失密码和确认密码输入框 -->
</form>

问题根源与修复方案 #

1. 前端表单缺失核心输入项 #

原前端代码未提供密码和确认密码的输入框，导致后端无法获取password和cpassword参数，两者比较自然不相等，触发“密码不匹配”错误。

补全后的前端表单：

<!-- 使用Bootstrap的前端表单 -->
<form action="signup.php" method="post" class="relative z-5  wow fadeInUp">
    <div class="form-group relative mb-25 mb-sm-20">
        <input type="text" class="form-control input-lg input-white shadow-5" id="username" placeholder="用户名" name="username" required>
        <i class="far fa-user transform-v-center"></i>
    </div>
    <div class="form-group relative mb-25 mb-sm-20">
        <input type="password" class="form-control input-lg input-white shadow-5" id="password" placeholder="密码" name="password" required>
        <i class="far fa-lock transform-v-center"></i>
    </div>
    <div class="form-group relative mb-25 mb-sm-20">
        <input type="password" class="form-control input-lg input-white shadow-5" id="cpassword" placeholder="确认密码" name="cpassword" required>
        <i class="far fa-lock transform-v-center"></i>
    </div>
    <button type="submit" class="btn btn-primary">注册</button>
</form>

2. 后端逻辑优化与安全修复 #

• 调整逻辑顺序：先判断用户名是否存在，再处理密码校验，避免变量赋值顺序错误影响判断；
• 添加错误捕获：数据库写入失败时输出具体错误信息，便于调试：

  if ($result) {
      $showAlert = true;
  } else {
      $showError = "数据库写入失败：" . mysqli_error($conn);
  }
  

• 防护SQL注入：替换直接拼接SQL的方式，使用预处理语句：

  $stmt = $conn->prepare("INSERT INTO `signup` (username, password, date) VALUES (?, ?, current_timestamp())");
  $stmt->bind_param("ss", $username, $hash);
  $stmt->execute();
  if ($stmt->affected_rows > 0) {
      $showAlert = true;
  } else {
      $showError = "数据库写入失败：" . $stmt->error;
  }
  $stmt->close();
  

3. 调试建议 #

• 临时添加变量输出，确认$_POST参数是否正确获取：

  var_dump($_POST); // 调试完成后删除
  

• 检查db_config.php的数据库连接配置是否正确，确保能正常连接目标数据库。

内容的提问来源于stack exchange，提问作者Bunny Egg