PHP项目如何实现用户登录？

wen PHP项目 2026-06-11 120

本文目录导读：

PHP项目如何实现用户登录？

数据库设计
注册功能（创建用户）
登录功能
会话验证（保护页面）
使用示例
退出登录
数据库连接配置
安全最佳实践

我来详细说明PHP项目实现用户登录的完整流程,包括安全最佳实践：

数据库设计

首先创建用户表：

CREATE TABLE users (
    id INT AUTO_INCREMENT PRIMARY KEY,
    username VARCHAR(50) UNIQUE NOT NULL,
    email VARCHAR(100) UNIQUE NOT NULL,
    password_hash VARCHAR(255) NOT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

注册功能（创建用户）

// register.php
<?php
require_once 'config.php'; // 数据库连接配置
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = trim($_POST['username']);
    $email = trim($_POST['email']);
    $password = $_POST['password'];
    $confirm_password = $_POST['confirm_password'];
    // 验证输入
    $errors = [];
    if (empty($username)) $errors[] = '用户名不能为空';
    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) $errors[] = '邮箱格式不正确';
    if (strlen($password) < 8) $errors[] = '密码至少8位';
    if ($password !== $confirm_password) $errors[] = '两次密码不一致';
    if (empty($errors)) {
        // 检查用户是否已存在
        $stmt = $pdo->prepare("SELECT id FROM users WHERE username = ? OR email = ?");
        $stmt->execute([$username, $email]);
        if ($stmt->fetch()) {
            $errors[] = '用户名或邮箱已存在';
        } else {
            // 密码哈希存储
            $password_hash = password_hash($password, PASSWORD_DEFAULT);
            $stmt = $pdo->prepare("INSERT INTO users (username, email, password_hash) VALUES (?, ?, ?)");
            if ($stmt->execute([$username, $email, $password_hash])) {
                header('Location: login.php?registered=1');
                exit;
            } else {
                $errors[] = '注册失败，请重试';
            }
        }
    }
}
?>
<!-- 注册表单 -->
<form method="POST">
    <input type="text" name="username" placeholder="用户名" required>
    <input type="email" name="email" placeholder="邮箱" required>
    <input type="password" name="password" placeholder="密码" required minlength="8">
    <input type="password" name="confirm_password" placeholder="确认密码" required>
    <button type="submit">注册</button>
    <?php if (!empty($errors)): ?>
        <div class="errors">
            <?php foreach ($errors as $error): ?>
                <p><?= htmlspecialchars($error) ?></p>
            <?php endforeach; ?>
        </div>
    <?php endif; ?>
</form>

登录功能

// login.php
<?php
session_start();
require_once 'config.php';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = trim($_POST['username']);
    $password = $_POST['password'];
    $remember = isset($_POST['remember']);
    $errors = [];
    if (empty($username)) $errors[] = '请输入用户名/邮箱';
    if (empty($password)) $errors[] = '请输入密码';
    if (empty($errors)) {
        // 查询用户（支持用户名或邮箱登录）
        $stmt = $pdo->prepare("SELECT id, username, password_hash FROM users 
                               WHERE username = ? OR email = ?");
        $stmt->execute([$username, $username]);
        $user = $stmt->fetch();
        if ($user && password_verify($password, $user['password_hash'])) {
            // 登录成功：设置Session
            $_SESSION['user_id'] = $user['id'];
            $_SESSION['username'] = $user['username'];
            $_SESSION['login_time'] = time();
            // "记住我"功能
            if ($remember) {
                $token = bin2hex(random_bytes(32));
                $expires = date('Y-m-d H:i:s', strtotime('+30 days'));
                // 存储token到数据库
                $stmt = $pdo->prepare("INSERT INTO login_tokens (user_id, token, expires_at) 
                                       VALUES (?, ?, ?)");
                $stmt->execute([$user['id'], $token, $expires]);
                // 设置Cookie
                setcookie('remember_token', $token, strtotime('+30 days'), '/', '', true, true);
            }
            // 重定向到首页
            header('Location: index.php');
            exit;
        } else {
            $errors[] = '用户名/邮箱或密码错误';
        }
    }
}
?>
<!-- 登录表单 -->
<form method="POST" action="login.php">
    <input type="text" name="username" placeholder="用户名或邮箱" required>
    <input type="password" name="password" placeholder="密码" required>
    <label>
        <input type="checkbox" name="remember"> 记住我
    </label>
    <button type="submit">登录</button>
    <?php if (!empty($errors)): ?>
        <div class="errors">
            <?php foreach ($errors as $error): ?>
                <p><?= htmlspecialchars($error) ?></p>
            <?php endforeach; ?>
        </div>
    <?php endif; ?>
</form>

会话验证（保护页面）

// auth_check.php - 用于需要登录的页面
<?php
session_start();
function isLoggedIn() {
    if (isset($_SESSION['user_id'])) {
        return true;
    }
    // 检查"记住我"的Cookie
    if (isset($_COOKIE['remember_token'])) {
        $token = $_COOKIE['remember_token'];
        global $pdo;
        $stmt = $pdo->prepare("SELECT user_id, expires_at FROM login_tokens 
                               WHERE token = ? AND expires_at > NOW()");
        $stmt->execute([$token]);
        $token_data = $stmt->fetch();
        if ($token_data) {
            // 恢复Session
            $stmt = $pdo->prepare("SELECT id, username FROM users WHERE id = ?");
            $stmt->execute([$token_data['user_id']]);
            $user = $stmt->fetch();
            if ($user) {
                $_SESSION['user_id'] = $user['id'];
                $_SESSION['username'] = $user['username'];
                return true;
            }
        }
        // 无效token，清除Cookie
        setcookie('remember_token', '', time() - 3600, '/');
    }
    return false;
}
function requireLogin() {
    if (!isLoggedIn()) {
        header('Location: login.php?redirect=' . urlencode($_SERVER['REQUEST_URI']));
        exit;
    }
}
?>

使用示例

// profile.php - 需要登录的页面
<?php
require_once 'auth_check.php';
requireLogin();
echo "欢迎您， " . htmlspecialchars($_SESSION['username']) . "！";
?>

退出登录

// logout.php
<?php
session_start();
// 清除所有Session变量
$_SESSION = array();
// 清除Session Cookie
if (ini_get("session.use_cookies")) {
    $params = session_get_cookie_params();
    setcookie(session_name(), '', time() - 42000,
        $params["path"], $params["domain"],
        $params["secure"], $params["httponly"]
    );
}
// 清除记住我的Cookie和数据库记录
if (isset($_COOKIE['remember_token'])) {
    $token = $_COOKIE['remember_token'];
    global $pdo;
    $stmt = $pdo->prepare("DELETE FROM login_tokens WHERE token = ?");
    $stmt->execute([$token]);
    setcookie('remember_token', '', time() - 3600, '/');
}
session_destroy();
header('Location: login.php?logged_out=1');
exit;
?>

数据库连接配置

// config.php
<?php
$host = 'localhost';
$dbname = 'your_database';
$username = 'your_username';
$password = 'your_password';
try {
    $pdo = new PDO("mysql:host=$host;dbname=$dbname;charset=utf8mb4", $username, $password);
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    $pdo->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC);
} catch(PDOException $e) {
    die("数据库连接失败: " . $e->getMessage());
}
?>

安全最佳实践

密码存储：使用 password_hash() 和 password_verify()
输入验证：始终验证和清理用户输入
输出编码：使用 htmlspecialchars() 防止XSS
SQL注入防护：使用预处理语句（PDO）
Session安全：设置 session.cookie_httponly 和 session.cookie_secure
CSRF防护：在表单中添加token验证
HTTPS：生产环境必须使用HTTPS
登录限制：限制登录尝试次数防止暴力破解

这是一个完整的用户登录系统实现，包含了注册、登录、会话管理、"记住我"功能和退出功能，根据项目需求，你可以添加验证码、邮箱验证、密码重置等功能来增强安全性。

本文地址： https://www.bmjup.com/post/5057.html