PHP - 登录页面

Question

我们都认为它有效但我测试了它并没有输出任何东西。它会检查是否有会话e.t.c，如果没有，那么它的意思是输出一个表单，但它不能让任何人启发我的错误吗？

代码：

<?php

session_start();

//Include Database Config.
include('../cdn/global/db.php');

//PDO Settings.
$opt = array( PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION );
$dsn = "mysql:host=$host;dbname=$dbname";

//Create a PDO Session.
$DBH = new PDO($dsn, $username, $password, $opt);

//Session Attributes.
$DBH->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$DBH->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);

$loginForm = "
<form method='POST' action='' class='pure-form' style='color: #000;'>

    <fieldset class='pure-group'>
        <input type='text' name='username' style='display: inline-block;' class='pure-input-1-2' placeholder='Username'><br>
    </fieldset>

    <fieldset class='pure-group'>
        <input type='password' name='password' style='display: inline-block;' class='pure-input-1-2' placeholder='Password'><br>
    </fieldset>

    <fieldset class='pure-group'>
        <button type='submit' style='display: inline-block;' class='pure-button pure-input-1-2 pure-button-primary'>Login</button>'
    </fieldset>

</form>";

if(isset($_POST['username']) && isset($_POST['password'])){
    echo $_POST['username'].'is trying to login with password'.$_POST['password'];
    $st = $DBH->prepare("SELECT :username FROM users WHERE username = :username AND password = :password");
    $st->bindParam(':password', $_POST['password']);
    $st->bindParam(':username', $_POST['username']);

    $st->execute();

    if($st->rowCount()){    
        $row = $st->fetch(PDO::FETCH_OBJ);
        $_SESSION['username'] = $row->username;
        echo $_SESSION['username'];
        return true;
    }
} else if(!isset($_SESSION['username'])) {
    echo $loginForm;
}

?>

Answer 1

我认为如果从前两行中删除isset，您的问题将得到解决，因此您的第一行应如下所示：

if(!$_SESSION['username'] && !    $_POST['username'] && ! $_POST['password']) { 
    echo $loginForm; 
} elseif(isset($_SESSION['username']) && isset($_POST['username']) && isset($_POST['password'])) {
    $grantAccess = login(); //after some serious validation or validate inside  
    if(!$grantAccess) { 
        echo 'Test 2';
    }
} 

Answer 2

就个人而言，我试图分开任务，这样我就能把事情做好。这基本上就是我做的。请注意，所有功能都将根据需要包含在自己的文件中，并包含在需要它们的任何页面中。我记下了感兴趣的领域：

<?php
session_start();
// This would be better as a static class so as not to create new connections all the time
// You can populate all the false values here with actual database info
// If you do it here, then the function will not need arguments when you go
// To use it. The only time you would populate the args after this point is if
// you need to connect to multiple databases on the same page.
function Connect($host = false,$username = false,$password = false,$dbname = false)
    {
        try {
                //Create a PDO Session.
                $con = new PDO("mysql:host=$host;dbname=$dbname", $username, $password,array( PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION ));
                //Session Attributes.
                $con->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
                $con->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
            }
        catch (PDOException $e) {
                echo "<code><pre>".print_r($e)."</pre></code>";
                $con    =   false;
            }

        return $con;
    }
// Since you are just assigning a variable some html, may as well make it a bit flexible in a function (just incase)
function LoginForm($settings = false)
    {
        $method =   (!empty($settings['method']))? $settings['method']:"post";
        $action =   (!empty($settings['action']))? $settings['action']:"";
        $id     =   (!empty($settings['id']))? ' id="'.$settings['id'].'"':"";
        $class  =   (!empty($settings['class']))? $settings['class']:"pure-form";

        ob_start();
?>
<form method='<?php echo $method; ?>' action='<?php echo $action; ?>' class='<?php echo $class; ?>' style='color: #000;'<?php echo $id; ?>>

    <fieldset class='pure-group'>
        <input type='text' name='username' style='display: inline-block;' class='pure-input-1-2' placeholder='Username'><br>
    </fieldset>

    <fieldset class='pure-group'>
        <input type='password' name='password' style='display: inline-block;' class='pure-input-1-2' placeholder='Password'><br>
    </fieldset>

    <fieldset class='pure-group'>
        <button type='submit' style='display: inline-block;' class='pure-button pure-input-1-2 pure-button-primary'>Login</button>
    </fieldset>

</form>
<?php
        $data   =   ob_get_contents();
        ob_end_clean(); 
        return $data;
    }

function fetch($sql = false,$bind = false,$obj = false)
    {
        if(empty($sql))
            return 0;

        $query  =   Connect()->prepare($sql);

        if(!$query)
            return 0;

        $query->execute($bind);

        while($result = $query->fetch(PDO::FETCH_ASSOC)) {
                $row[]  =   $result;
            }

        if(!empty($row)) 
            $row    =   ($obj)? (object) $row : $row;
        else
            $row    =   0;

        return $row;
    }

function user_login($username = false, $password = false)
    {
        $st     =   fetch("SELECT username,password FROM users WHERE username = :username",array(":username"=>$username));
        $valid  =   false;
        if($st != 0) {
                if($st[0]['password'] == $password) {
                        $_SESSION['username'] = $row[0]['username'];
                        $valid  =   true;
                    }
            }

        return $valid;
    }

function user_logout($location = 'loggedout.php')
    {
        if(isset($_REQUEST['action']) && $_REQUEST['action'] == 'logout') {
                session_destroy();
                header("Location: ".$location);
                exit;
            }
    }

// Include Database Config.
// If you just have $username,$password,$host,$dbname here,
// you can skip this if you just add those values into the Connect()
// function as default arguements
include('../cdn/global/db.php');
//Add static function that listens for logout
user_logout();
// If username set (password is also going to be set)
if(!empty($_POST['username']))
    // Get true/false for user hit
    echo (user_login($_POST['username'],$_POST['password']))? "Welcome ".htmlspecialchars($_SESSION['username']) : "Invalid username and/or password!";
// If there is no session username, show login form
echo (empty($_SESSION['username']))? LoginForm() : '<a href="?action=logout">Log Out</a>';
?>

编辑：如何在这种情况下（一般意义上）这样做

/functions/functions.php

<?php
function Connect($host = false,$username = false,$password = false,$dbname = false)
    {
        try {
                //Create a PDO Session.
                $con = new PDO("mysql:host=$host;dbname=$dbname", $username, $password,array( PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION ));
                //Session Attributes.
                $con->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
                $con->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
            }
        catch (PDOException $e) {
                echo "<code><pre>".print_r($e)."</pre></code>";
                $con    =   false;
            }

        return $con;
    }
// Since you are just assigning a variable some html, may as well make it a bit flexible in a function (just incase)
function LoginForm($settings = false)
    {
        $method =   (!empty($settings['method']))? $settings['method']:"post";
        $action =   (!empty($settings['action']))? $settings['action']:"";
        $id     =   (!empty($settings['id']))? ' id="'.$settings['id'].'"':"";
        $class  =   (!empty($settings['class']))? $settings['class']:"pure-form";

        ob_start();
?>
<form method='<?php echo $method; ?>' action='<?php echo $action; ?>' class='<?php echo $class; ?>' style='color: #000;'<?php echo $id; ?>>

    <fieldset class='pure-group'>
        <input type='text' name='username' style='display: inline-block;' class='pure-input-1-2' placeholder='Username'><br>
    </fieldset>

    <fieldset class='pure-group'>
        <input type='password' name='password' style='display: inline-block;' class='pure-input-1-2' placeholder='Password'><br>
    </fieldset>

    <fieldset class='pure-group'>
        <button type='submit' style='display: inline-block;' class='pure-button pure-input-1-2 pure-button-primary'>Login</button>
    </fieldset>

</form>
<?php
        $data   =   ob_get_contents();
        ob_end_clean(); 
        return $data;
    }

function fetch($sql = false,$bind = false,$obj = false)
    {
        if(empty($sql))
            return 0;

        $query  =   Connect()->prepare($sql);

        if(!$query)
            return 0;

        $query->execute($bind);

        while($result = $query->fetch(PDO::FETCH_ASSOC)) {
                $row[]  =   $result;
            }

        if(!empty($row)) 
            $row    =   ($obj)? (object) $row : $row;
        else
            $row    =   0;

        return $row;
    }

function user_login($username = false, $password = false)
    {
        $st     =   fetch("SELECT username,password FROM users WHERE username = :username",array(":username"=>$username));
        $valid  =   false;
        if($st != 0) {
                if($st[0]['password'] == $password) {
                        $_SESSION['username'] = $row[0]['username'];
                        $valid  =   true;
                    }
            }

        return $valid;
    }

function user_logout($location = 'loggedout.php')
    {
        if(isset($_REQUEST['action']) && $_REQUEST['action'] == 'logout') {
                session_destroy();
                header("Location: ".$location);
                exit;
            }
    }
?>

的login.php

session_start();
include_once(__DIR__.'/functions/functions.php');
user_logout();
?><html>
<head>
</head>
<body>
<?php
if(!empty($_POST['username']))
    echo (user_login($_POST['username'],$_POST['password']))? "Welcome ".htmlspecialchars($_SESSION['username']) : "Invalid username and/or password!";

echo (empty($_SESSION['username']))? LoginForm() : '<a href="?action=logout">Log Out</a>';
?>
</body>
</html>

Answer 3

您还可以创建一个类来管理您的用户。让我们创建db.php类。

<?php

class Db {

private static $_dbase = 'data';
private static $_username = 'root';
private static $_passwd = '';
private static $_host = 'localhost';
private static $_options = array(PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION);
private static $_dsn;
private static $_db;

function __construct() {

}

public static function getDB() {
    if (!isset(self::$_db)) {
        try {
            self::$_dsn = 'mysql:host=' . self::$_host . ';dbname=' . self::$_dbase;
            self::$_db = new PDO(self::$_dsn, self::$_username, self::$_passwd, self::$_options);
        } catch (PDOException $exc) {
            echo $exc->getMessage();
        }
    }
    return self::$_db;
  }

}

现在让我们创建User.php类

<?php
  session_start();
  require_once 'db.php';
 class USER {

private $db;

function __construct() {
    $this->db = Db::getDb();
}

public function register($uname, $umail, $upass) {
    try {
        $new_password = password_hash($upass, PASSWORD_DEFAULT);
        //create the activasion code
        $activation = md5(uniqid(rand(), true));
        $stmt = $this->db->prepare("INSERT INTO users(user_name,user_email,user_pass,active) 
                                                   VALUES(:uname, :umail, :upass,:active)");

        $stmt->bindparam(":uname", $uname);
        $stmt->bindparam(":umail", $umail);
        $stmt->bindparam(":upass", $new_password);
        $stmt->bindparam(":active", $activation);
        $stmt->execute();
        $id = $this->db->lastInsertId('memberID');
        $this->sendMail($id, $activation);
        $this->redirect('sign-up.php?joined');
        return $stmt;
    } catch (PDOException $e) {
        echo $e->getMessage();
    }
}

public function login($uname, $umail, $upass) {
    try {
        $stmt = $this->db->prepare("SELECT * FROM `users` WHERE `user_name` = :uname AND `user_email` = :umail LIMIT 1");
        $stmt->execute(array(':uname' => $uname, ':umail' => $umail));
        $userRow = $stmt->fetch(PDO::FETCH_ASSOC);
        if ($stmt->rowCount() > 0) {
            //verifying user.
            if (password_verify($upass, $userRow['user_pass']) && $userRow['active'] === 'Yes') {
                $_SESSION['user_session'] = $userRow['user_id'];
                return true;
            } else {
                return false;
            }
        }
    } catch (PDOException $e) {
        echo $e->getMessage();
    }
}

private function sendMail($email,$id, $activation) {
    //send email to the user for account activation.
    $to = $email;
    $subject = "Registration Confirmation";
    $body = "Thank you for registering at demo site.\n\n To activate your account, please click on this link:\n\n " . DIR . "activate.php?x=$id&y=$activation\n\n Regards Site Admin \n\n";
    $additionalheaders = "From: <" . SITEEMAIL . ">\r\n";
    $additionalheaders .= "Reply-To: " . SITEEMAIL . "";
    mail($to, $subject, $body, $additionalheaders);
}
//check if the user is logged in
public function is_loggedin() {
    if (isset($_SESSION['user_session'])) {
        return true;
    }
}
// redirect the user.
public function redirect($url) {
    header("Location: $url");
}
//user log out
public function logout() {
    session_destroy();
    unset($_SESSION['user_session']);
    return true;
}

//display login form
public function display_login_form() {
    return "
     <form method='POST' action='' class='pure-form' style='color: #000;'>

<fieldset class='pure-group'>
    <input type='text' name='username' style='display: inline-block;' class='pure-input-1-2' placeholder='Username'><br>
</fieldset>

<fieldset class='pure-group'>
    <input type='password' name='password' style='display: inline-block;' class='pure-input-1-2' placeholder='Password'><br>
</fieldset>

<fieldset class='pure-group'>
    <button type='submit' style='display: inline-block;' class='pure-button pure-input-1-2 pure-button-primary'>Login</button>'
</fieldset>

  </form>";
   }

}

我们将检查用户是否已登录，如果没有显示登录表单。

<?php 
   require_once 'User.php';
   $User = new User();
   $form = '';
   if($User->is_loggedin()){
      $User->redirect('private.php');
   }else{
     $form = $User->display_login_form();
   }
  ?>
   <!DOCTYPE html>
     <html>
   <head>
    <title>Demo</title>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
</head>
<body>
    <div><?php echo $form; ?></div>
</body>