php实现站内信
PHP 实现站内信功能
站内信功能通常包括发送、接收、查看和删除消息等操作。以下是实现站内信功能的关键步骤和代码示例。
数据库设计
创建数据库表存储站内信信息。表结构可以包含以下字段:
CREATE TABLE messages (
id INT AUTO_INCREMENT PRIMARY KEY,
sender_id INT NOT NULL,
receiver_id INT NOT NULL,
subject VARCHAR(255) NOT NULL,
content TEXT NOT NULL,
is_read TINYINT(1) DEFAULT 0,
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
FOREIGN KEY (sender_id) REFERENCES users(id),
FOREIGN KEY (receiver_id) REFERENCES users(id)
);
发送消息功能
创建表单页面用于发送消息:
<form action="send_message.php" method="post">
<input type="text" name="receiver_id" placeholder="接收者ID">
<input type="text" name="subject" placeholder="主题">
<textarea name="content" placeholder="内容"></textarea>
<button type="submit">发送</button>
</form>
处理发送逻辑的 PHP 代码:

<?php
session_start();
require 'db_connect.php';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$sender_id = $_SESSION['user_id'];
$receiver_id = $_POST['receiver_id'];
$subject = $_POST['subject'];
$content = $_POST['content'];
$stmt = $pdo->prepare("INSERT INTO messages (sender_id, receiver_id, subject, content) VALUES (?, ?, ?, ?)");
$stmt->execute([$sender_id, $receiver_id, $subject, $content]);
header("Location: messages.php");
exit;
}
?>
查看收件箱功能
显示用户收到的消息列表:
<?php
session_start();
require 'db_connect.php';
$user_id = $_SESSION['user_id'];
$stmt = $pdo->prepare("SELECT m.*, u.username as sender_name FROM messages m JOIN users u ON m.sender_id = u.id WHERE m.receiver_id = ? ORDER BY m.created_at DESC");
$stmt->execute([$user_id]);
$messages = $stmt->fetchAll();
foreach ($messages as $message) {
echo "<div class='message'>";
echo "<h3>" . htmlspecialchars($message['subject']) . "</h3>";
echo "<p>发件人: " . htmlspecialchars($message['sender_name']) . "</p>";
echo "<p>" . htmlspecialchars($message['content']) . "</p>";
echo "<small>" . $message['created_at'] . "</small>";
echo "</div>";
}
?>
标记已读功能
当用户查看消息时,将其标记为已读:

<?php
session_start();
require 'db_connect.php';
if (isset($_GET['message_id'])) {
$message_id = $_GET['message_id'];
$user_id = $_SESSION['user_id'];
// 验证消息属于当前用户
$stmt = $pdo->prepare("UPDATE messages SET is_read = 1 WHERE id = ? AND receiver_id = ?");
$stmt->execute([$message_id, $user_id]);
}
?>
删除消息功能
允许用户删除收到的消息:
<?php
session_start();
require 'db_connect.php';
if (isset($_GET['delete_id'])) {
$message_id = $_GET['delete_id'];
$user_id = $_SESSION['user_id'];
$stmt = $pdo->prepare("DELETE FROM messages WHERE id = ? AND receiver_id = ?");
$stmt->execute([$message_id, $user_id]);
header("Location: messages.php");
exit;
}
?>
安全性考虑
实现站内信功能时应注意以下安全措施:
- 使用预处理语句防止SQL注入
- 对输出内容使用htmlspecialchars()函数防止XSS攻击
- 验证用户权限,确保用户只能操作自己的消息
- 对敏感操作使用CSRF令牌保护
性能优化建议
对于大型系统,可以考虑以下优化:
- 对消息表进行分表处理
- 添加索引提高查询效率
- 实现消息分页功能
- 考虑使用缓存机制减少数据库查询
以上代码提供了站内信功能的基本实现框架,可以根据实际需求进行扩展和完善。






