<?
php
// 数据库连接信息可以放在配置文件中
$config = [
'servername' => "localhost",
'username' => "root",
'password' => "root",
'dbname' => "hzj"
];
// 创建连接
$conn = new mysqli($config['servername'], $config['username'], $config['password'], $config['dbname']);
// 检查连接
if ($conn->connect_error) {
die("连接失败: " . $conn->connect_error);
}
// 开启会话
session_start();
// 生成或验证 CSRF 令牌
if (!isset($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
if ($_SERVER["REQUEST_METHOD"] == "POST") {
// 验证 CSRF 令牌
if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
die("CSRF 验证失败");
}
// 获取用户输入
并进行验证和过滤
if (isset($_POST['username']) && isset($_POST['password'])) {
$user_input_username = filter_var($_POST['username'], FILTER_SANITIZE_STRING);
$user_input_password = filter_var($_POST['password'], FILTER_SANITIZE_STRING);
// 对用户名和密码进行更详细的验证
if (strlen($user_input_username) < 3 || strlen($user_input_username) > 20) {
echo "用户名长度应在 3 到 20 个字符之间";
} elseif (strlen($user_input_password) < 6) {
echo "密码长度应至少为 6 个字符";
} else {
// 使用预处理语句防止 SQL 注入
$stmt = $conn->prepare("SELECT id, password FROM users WHERE username = ?");
$stmt->bind_param("s", $user_input_username);
$stmt->execute();
$result = $stmt->get_result();
if ($result->num_rows > 0) {
$row = $result->fetch_assoc();
// 验证密码
if (password_verify($user_input_password, $row['password'])) {
// 可以在这里进行更详细的用户信息处理，如设置会话等
$_SESSION['user_id'] = $row['id'];
$_SESSION['username'] = $user_input_username;
header('Location: indexss.
php');
} else {
echo "用户名或密码错误";
}
} else {
echo "用户名或密码错误";
}
// 关闭预处理语句
$stmt->close();
}
} else {
echo "请输入用户名和密码";
}
}
// 关闭连接
$conn->close();
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>登录页面</title>
</head>
<body>
<form method="post">
<input type="hidden" name="csrf_token" value="<?
php echo $_SESSION['csrf_token']; ?>">
<label for="username">用户名:</label>
<input type="text" id="username" name="username" required>
<label for="password">密码:</label>
<input type="password" id="password" name="password" required>
<input type="submit" value="登录"><br>
还没有账号?<a href="xdr.
php">点击注册</a>
<a href="indexs.
php">重置</a>
<a href="lm.
php">添加栏目</a>
</form>
</body>
</html>
扫一扫
1186
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
