php如何实现登录验证

PHP 登录验证实现方法

使用会话（Session）和表单验证

创建登录表单（HTML）：

<form action="login.php" method="post">
    <input type="text" name="username" placeholder="Username" required>
    <input type="password" name="password" placeholder="Password" required>
    <button type="submit">Login</button>
</form>

处理登录逻辑（login.php）：

session_start();
$valid_username = 'admin';
$valid_password_hash = password_hash('secret123', PASSWORD_DEFAULT);

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = $_POST['username'] ?? '';
    $password = $_POST['password'] ?? '';

    if ($username === $valid_username && password_verify($password, $valid_password_hash)) {
        $_SESSION['logged_in'] = true;
        $_SESSION['username'] = $username;
        header('Location: dashboard.php');
        exit;
    } else {
        $error = "Invalid credentials";
    }
}

数据库验证方式

MySQL数据库验证示例：

session_start();
$db = new PDO('mysql:host=localhost;dbname=myapp', 'dbuser', 'dbpass');

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $stmt = $db->prepare("SELECT id, password FROM users WHERE username = ?");
    $stmt->execute([$_POST['username']]);
    $user = $stmt->fetch();

    if ($user && password_verify($_POST['password'], $user['password'])) {
        $_SESSION['user_id'] = $user['id'];
        header('Location: members.php');
        exit;
    }
}

安全增强措施

密码哈希处理：

// 注册时存储哈希密码
$hashed_password = password_hash($plain_password, PASSWORD_DEFAULT);

// 登录时验证
password_verify($input_password, $stored_hash);

防止SQL注入：

// 使用预处理语句
$stmt = $pdo->prepare("SELECT * FROM users WHERE email = ?");
$stmt->execute([$email]);

登录状态检查

保护页面访问（dashboard.php）：

session_start();
if (!isset($_SESSION['logged_in'])) {
    header('Location: login.php');
    exit;
}

退出登录实现

logout.php：

session_start();
session_destroy();
header('Location: login.php');
exit;