php实现登录修改密码
PHP 实现登录与修改密码功能
数据库准备
创建用户表结构示例（MySQL）：
CREATE TABLE users (
id INT AUTO_INCREMENT PRIMARY KEY,
username VARCHAR(50) NOT NULL UNIQUE,
password VARCHAR(255) NOT NULL,
email VARCHAR(100) NOT NULL UNIQUE
);用户登录实现
创建登录表单（login.php）：
<form action="authenticate.php" method="post">
<input type="text" name="username" placeholder="用户名" required>
<input type="password" name="password" placeholder="密码" required>
<button type="submit">登录</button>
</form>认证处理（authenticate.php）：
session_start();
$db = new PDO('mysql:host=localhost;dbname=your_db', 'username', 'password');
$username = $_POST['username'];
$password = $_POST['password'];
$stmt = $db->prepare("SELECT * FROM users WHERE username = ?");
$stmt->execute([$username]);
$user = $stmt->fetch();
if ($user && password_verify($password, $user['password'])) {
$_SESSION['user_id'] = $user['id'];
header("Location: dashboard.php");
} else {
echo "无效的登录凭证";
}密码修改功能
创建修改密码表单（change_password.php）：
<form action="update_password.php" method="post">
<input type="password" name="current_password" placeholder="当前密码" required>
<input type="password" name="new_password" placeholder="新密码" required>
<input type="password" name="confirm_password" placeholder="确认新密码" required>
<button type="submit">更新密码</button>
</form>密码更新处理（update_password.php）：
session_start();
if (!isset($_SESSION['user_id'])) {
header("Location: login.php");
exit;
}
$db = new PDO('mysql:host=localhost;dbname=your_db', 'username', 'password');
$user_id = $_SESSION['user_id'];
$current_password = $_POST['current_password'];
$new_password = $_POST['new_password'];
$confirm_password = $_POST['confirm_password'];
if ($new_password !== $confirm_password) {
die("新密码不匹配");
}
$stmt = $db->prepare("SELECT password FROM users WHERE id = ?");
$stmt->execute([$user_id]);
$user = $stmt->fetch();
if (!password_verify($current_password, $user['password'])) {
die("当前密码错误");
}
$hashed_password = password_hash($new_password, PASSWORD_DEFAULT);
$update_stmt = $db->prepare("UPDATE users SET password = ? WHERE id = ?");
$update_stmt->execute([$hashed_password, $user_id]);
echo "密码更新成功";安全注意事项
密码存储必须使用password_hash()函数进行哈希处理，验证时使用password_verify()
所有数据库操作应使用预处理语句防止SQL注入
敏感操作前必须验证用户会话状态
新密码应设置复杂度要求（如最小长度、特殊字符等）
密码强度验证示例
function validate_password($password) {
if (strlen($password) < 8) {
return "密码至少需要8个字符";
}
if (!preg_match("/[A-Z]/", $password)) {
return "密码必须包含至少一个大写字母";
}
if (!preg_match("/[0-9]/", $password)) {
return "密码必须包含至少一个数字";
}
return true;
}会话管理
用户登出实现（logout.php）：
session_start();
session_unset();
session_destroy();
header("Location: login.php");
