关于PHP网络验证被破。解的可能性探讨

如果所谓的脚本也是在服务器端的话，我不知道算来算去是啥意思，如果是指客户端（浏览器javascript）我也不知道什么意思，发个随机数做验证码卜升告吗？用来做SessionID还差不多，不过就算是这样也没必要型明MD5算来算去，基本没有意义，别人能拿到你的MD5吗？除非攻破服务器。

======

请说明清楚笑闭

login.html

<form id="form1" name="form1" method="post" action="checklogin.php">

<table width="400">

<tr>

<th width="27%" scope="row">用户名</th>

<td width="73%"><input name="user_name" type="text" id="user_name" /></td>

</tr>

<tr>

<th scope="row">密码</th>

<td><input name="user_pwd" type="password" id="user_pwd" /></td>

</tr>

<tr>

<th scope="row">请填写答案 </th>

<td><input name="yzm" type="text" id="yzm" size="5" />

123</td>

</tr>

<tr>

<td colspan="2" scope="row"><div align="center">

<input type="submit" name="Submit" value=" 登录 " />

</div>薯丛</td>

</tr>

</table>

</form>

checklogin.php

<?php

session_start()

require_once("../include/class/Mysql.class.php")

require_once("../include/class/数雀樱FuncAdmin.class.php")

require_once("../include/class/Users.class.php")

$db = new Mysql()

$db->getConnection(1)

$db->select_db()

$db->query("set names gb2312")

$f = new FuncAdmin()

if(!empty($_POST['Submit'])){

//判断登录

$user_name = $_POST['user_name']

$user_pwd = $_POST['user_pwd']

$yzm = $_POST['yzm']

//加强验证

//此处很重要但没写出呢cxmcook

if(empty($user_name) || empty($user_pwd)){

$f->alert_back("用户名与密码不能为空！")

}

$user = new Users()

$sql = $user->get_select_sql(" where user_name='".$user_name."' and user_pwd='".$user_pwd."' ")

$rs = $db->query($sql)

$row = $db->fetch_array($rs)

//var_dump($row)

//die("<hr>")

$rownum = $db->num_rows($rs)

//die('=========='.$rownum)

if( $rownum >0 ){

//$row = $db->fetch_array($rs)

$_SESSION['admin'] = 'admin'

$_SESSION['user_id'] = $row['user_id']

$_SESSION['user_name'] = $row['user_name']

$_SESSION['user_realname'] = $row['user_realname']

$_SESSION['user_last_logintime'] = $row['user_last_logintime']

$_SESSION['user_last_loginIp'] = $row['user_last_loginIp']

$_SESSION['user_loginnum'] = $row['user_loginnum']

//header("Location:index.php")

echo "<script>

alert('登录成功！".$_SESSION['user_realname']."')

location='index.php'

</script>"

}else{

$f->admin_tip("用户名或密码岁局错误！")

}

}

?>

---