php实现登录上传图片
PHP实现登录与图片上传功能
登录功能实现
创建登录表单HTML文件（login.html）：
<form action="login.php" method="post">
<input type="text" name="username" placeholder="用户名">
<input type="password" name="password" placeholder="密码">
<button type="submit">登录</button>
</form>处理登录的PHP文件（login.php）：
<?php
session_start();
$valid_username = "admin";
$valid_password = "123456";
if ($_POST['username'] == $valid_username && $_POST['password'] == $valid_password) {
$_SESSION['logged_in'] = true;
header("Location: upload.php");
} else {
echo "用户名或密码错误";
}
?>图片上传功能实现
创建上传表单HTML文件（upload.php）：
<?php
session_start();
if (!isset($_SESSION['logged_in']) || !$_SESSION['logged_in']) {
header("Location: login.html");
exit;
}
?>
<form action="upload_handler.php" method="post" enctype="multipart/form-data">
<input type="file" name="image">
<button type="submit">上传图片</button>
</form>处理上传的PHP文件（upload_handler.php）：
<?php
session_start();
if (!isset($_SESSION['logged_in']) || !$_SESSION['logged_in']) {
header("Location: login.html");
exit;
}
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["image"]["name"]);
$imageFileType = strtolower(pathinfo($target_file, PATHINFO_EXTENSION));
// 检查是否为真实图片
if (isset($_POST["submit"])) {
$check = getimagesize($_FILES["image"]["tmp_name"]);
if ($check === false) {
die("文件不是图片");
}
}
// 检查文件大小
if ($_FILES["image"]["size"] > 500000) {
die("文件太大");
}
// 允许特定格式
$allowed_types = ["jpg", "png", "jpeg", "gif"];
if (!in_array($imageFileType, $allowed_types)) {
die("只允许JPG, JPEG, PNG和GIF格式");
}
// 上传文件
if (move_uploaded_file($_FILES["image"]["tmp_name"], $target_file)) {
echo "文件". htmlspecialchars(basename($_FILES["image"]["name"])). "上传成功";
} else {
echo "上传失败";
}
?>安全注意事项
创建uploads目录并设置权限：
mkdir uploads
chmod 755 uploads在upload_handler.php中添加更多安全检查：
// 防止目录遍历攻击
if (strpos($_FILES["image"]["name"], '../') !== false) {
die("非法文件名");
}
// 生成唯一文件名防止覆盖
$new_filename = uniqid() . '.' . $imageFileType;
$target_file = $target_dir . $new_filename;数据库集成（可选）
如果需要将上传记录存入数据库：
// 连接数据库
$conn = new mysqli("localhost", "username", "password", "database");
// 存储上传记录
$stmt = $conn->prepare("INSERT INTO uploads (filename, upload_time) VALUES (?, NOW())");
$stmt->bind_param("s", $new_filename);
$stmt->execute();
$stmt->close();
$conn->close();
