php 站内消息 实现
站内消息系统实现
在PHP中实现站内消息系统需要设计数据库结构、编写消息发送、接收和显示的代码。以下是关键步骤和示例代码:
数据库设计
创建两个表:users(用户表)和messages(消息表)

CREATE TABLE users (
id INT AUTO_INCREMENT PRIMARY KEY,
username VARCHAR(50) NOT NULL,
password VARCHAR(255) NOT NULL
);
CREATE TABLE messages (
id INT AUTO_INCREMENT PRIMARY KEY,
sender_id INT NOT NULL,
receiver_id INT NOT NULL,
subject VARCHAR(100) NOT NULL,
body TEXT NOT NULL,
is_read BOOLEAN DEFAULT FALSE,
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
FOREIGN KEY (sender_id) REFERENCES users(id),
FOREIGN KEY (receiver_id) REFERENCES users(id)
);
发送消息功能
创建发送消息的表单和处理脚本:
// send_message.php
session_start();
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
require 'db_connection.php';
$sender_id = $_SESSION['user_id'];
$receiver_id = $_POST['receiver_id'];
$subject = htmlspecialchars($_POST['subject']);
$body = htmlspecialchars($_POST['body']);
$stmt = $pdo->prepare("INSERT INTO messages (sender_id, receiver_id, subject, body) VALUES (?, ?, ?, ?)");
$stmt->execute([$sender_id, $receiver_id, $subject, $body]);
header("Location: messages.php?success=1");
exit();
}
接收消息功能
显示用户收到的消息:

// messages.php
session_start();
require 'db_connection.php';
$user_id = $_SESSION['user_id'];
$stmt = $pdo->prepare("SELECT m.*, u.username as sender_name
FROM messages m
JOIN users u ON m.sender_id = u.id
WHERE m.receiver_id = ?
ORDER BY m.created_at DESC");
$stmt->execute([$user_id]);
$messages = $stmt->fetchAll(PDO::FETCH_ASSOC);
标记消息为已读
当用户查看消息时更新阅读状态:
// view_message.php
session_start();
require 'db_connection.php';
$message_id = $_GET['id'];
$user_id = $_SESSION['user_id'];
// 验证消息属于当前用户
$stmt = $pdo->prepare("UPDATE messages SET is_read = TRUE WHERE id = ? AND receiver_id = ?");
$stmt->execute([$message_id, $user_id]);
$stmt = $pdo->prepare("SELECT m.*, u.username as sender_name
FROM messages m
JOIN users u ON m.sender_id = u.id
WHERE m.id = ?");
$stmt->execute([$message_id]);
$message = $stmt->fetch(PDO::FETCH_ASSOC);
前端显示
在HTML中显示消息列表:
<!-- messages.php 的HTML部分 -->
<div class="message-list">
<?php foreach ($messages as $message): ?>
<div class="message <?= $message['is_read'] ? 'read' : 'unread' ?>">
<h4><?= htmlspecialchars($message['subject']) ?></h4>
<p>From: <?= htmlspecialchars($message['sender_name']) ?></p>
<p><?= substr(htmlspecialchars($message['body']), 0, 100) ?>...</p>
<a href="view_message.php?id=<?= $message['id'] ?>">Read More</a>
</div>
<?php endforeach; ?>
</div>
安全注意事项
- 对所有用户输入使用
htmlspecialchars()过滤 - 使用预处理语句防止SQL注入
- 验证当前用户是否有权访问特定消息
- 对敏感操作实施CSRF保护
扩展功能建议
- 添加消息回复功能
- 实现消息分类(收件箱、发件箱、已读、未读)
- 添加消息搜索功能
- 实现消息删除功能(软删除或硬删除)
- 添加消息通知(如未读消息数量提示)
以上实现提供了站内消息系统的基本框架,可根据具体需求进行扩展和优化。






