PHP会话登录和注销

Question

我必须做一个简单的站点，您可以登录和注销，如果用户登录了，他们会看到一些原本不会的功能。 我对网络开发不是很好，但是我设法将某些东西整合在一起，似乎很奏效。 我已决定在登录和注销时不希望将用户重定向到另一个页面，因此这使我更难理解。

我只是想知道我是否打算以正确的方式开始并销毁会话，并且是否有人可以给我任何指示，以使它变得更好。

<?php


if(isset($_POST['logout'])) {
    session_destroy();
    }
}
    session_start();
if(!isset($_SESSION['username'])) {
    if (!empty($_POST['username']) && !empty($_POST['password'])) {
        $result = mysql_query("SELECT * FROM users WHERE username ='$_POST['username']' AND password = '$_POST['password']'");
        if(mysql_num_rows($result)) 
            $_SESSION['username'] = $_POST['username'];
        }
        else {
            echo "";
        }
    }
}
?>
        <?php if(!isset($_SESSION['username'])) {
                echo '<div id = "account">
                        <form name="input" action="index.php" method="post">
                            Username:<input type="text" name="username" /> Password:<input type="password" name="password" />
                            <input type="submit" value="GO!" />
                        </form>
            }
            else {
                    echo "Signed in"
                    <form name='logout' action='index.php' method='post'>
                    <input type='submit'value='Reset' name='logout'/>
                    ";
            } ?> 
            <?php
            $test = mysql_query("SELECT * FROM posts ORDER BY post_id DESC");
            if($test) { 
                while($row = mysql_fetch_array($test)) { 
                    echo '<div class="posts">';
                        echo "$row[post]"; 
                    echo '</div>';
                }
            }

Answer 1

我处理了您的代码并进行了许多更改。 我试图添加很多评论，以使其更易于理解。 希望没有语法错误，但是我无法进行测试，因为我没有MySQL数据库等。

这是您的主要代码：

<?php
//When you are developing and testing, set the error level as high as possible.
//This will help you find problems early. A well written program will have no errors and warnings, ever.
error_reporting(E_ALL | E_STRICT);

//Starting the session should be one of the first things your code does, and should only be done once.
session_start();

require 'config.php';

if(isset($_POST['logout']))
{
    //I don't think there is any reason to check if username is set. If you are logging out, just destroy.
    session_destroy();

    //Also unset the session username since session_destroy() does not affect existing globals.
    unset($_SESSION['username']);
}
//I changed this to elseif, because there should not be a condition where you are logging out and checking for a login.
elseif(!isset($_SESSION['username']))
{
    //You should not assume that variables are set, because accessing them if they are not set
    //will cause a warning. I've added isset().
    if(isset($_POST['username']) && !empty($_POST['username']) && isset($_POST['password']) && !empty($_POST['password']))
    {
        //You absolutely MUST escape your strings or you are at risk of SQL injection.
        //Use mysql_real_escape_string() for this.
        $username = mysql_real_escape_string($_POST['username']);
        $password = mysql_real_escape_string($_POST['password']);
        $result = mysql_query("SELECT * FROM members WHERE username ='$username' AND password = '$password'");

        //You should probably check that the value === 1 here.
        //I'm assuming it should always be 1 or 0.
        if(0 === mysql_num_rows($result))
        {
            $_SESSION['username'] = $username;
        }
        else {
            echo "Fail :(";
        }
    }
    //If you put an else statement here, you could print an error for if the username was not specified.
}

//You should not have SQL queries in your template, so I moved this here.
//Notice that I'm just setting $posts to the data. It's best to just pass
//the data, and format it in the template.
$result = mysql_query("SELECT * FROM posts ORDER BY post_id DESC");
if($result)
{
    $posts = array();

    while($row = mysql_fetch_array($result))
    {
        $posts[] = $row['post'];
    }
}
else
{
    $posts = false;
}

//Try to separate code logic from templates.
//Your program is small, so it's not that important, but I would do it anyway.
require 'template.php';
?>

这是您的模板代码，应该放在一个名为template.php的新文件中：

<div id = "container">
    <h1>#HookyGear Bay</h1>
    <div id = "login">
        <?php if(!isset($_SESSION['username'])) {
                echo '<div id = "accountBox">
                        <form name="input" action="index.php" method="post">
                            Username:<input type="text" name="username" /> Password:<input type="password" name="password" />
                            <input type="submit" value="Sign In" />
                        </form>
                </div>';
            }
            else {
                    echo "<div id='accountBox'>You Are logged in as ".$_SESSION['username']."
                    <form name='logout' action='index.php' method='post'>
                    <input type='submit'value='Reset' name='logout'/>
                    </div> ";
            } ?> 
    </div>

        <div id = "content">
            <?php

            if(false !== $posts)
            {
                foreach($posts as $post)
                {
                    echo '<div class="blogPosts">'.$post.'</div>';
                }
            }
            else { ?> 
                <div class="blogPosts"><?php echo "no blog posts"; ?></div> 
            <?php
            }
            ?>

            <div style="clear:both;"></div>
        </div>
</div>

Answer 2

不必每次页面加载时都检查$ _POST ['logout']，而是可以将用户重定向到其他特定于注销的页面。

Answer 3

您可以在调用session尝试method。 就像我的

在这里它将检查您是否连接到数据库，我将其命名为connect.inc.php

<?php
if(!mysql_connect('localhost', 'root', '')|| !mysql_select_db('byp_db'))
{
die(mysql_error());
}
?>

接下来，我创建了core.inc.php ，它将在其中检查您是否已经在session您将在其中使用loggedin()方法

<?php
error_reporting(E_ALL ^ E_NOTICE); 
ob_start();
session_start();
$current_file = $_SERVER['SCRIPT_NAME'];
$http_referer = $_SERVER['HTTP_REFERER'];

function loggedin() {

      if(isset($_SESSION['user_p_info_id'])&&!empty($_SESSION['user_p_info_id'])) {
    return true;

}else {
    return false;
}
}

function getuserfield($field){
$query = "SELECT `$field` FROM `user_p_info` where `user_p_info_id`='".$_SESSION['user_p_info_id']."'";
if($query_run = mysql_query($query)){

    if($query_result = mysql_result($query_run, 0, $field)){
        return $query_result;
    }

}
}
?>

接下来是您将创建您的登录表单

<?php

require 'connections/connect.inc.php';
require 'connections/core.inc.php';

if(isset($_POST['uname']) && isset($_POST['password'])){

$uname = $_POST['uname'];
$pword = $_POST['password'];

//echo $uname;
//echo $pword;
if(!empty($uname)&&!empty($pword)){
$query_login = "SELECT * FROM user_a_info where username = '$uname' and password = '$pword'";
//echo $query_login;

$query_result = mysql_query($query_login);
$num_rows = mysql_num_rows($query_result);  
    if($num_rows == 0){

?>

<script type="text/javascript"> 
alert("Invalid Data !");  
</script>


<?php                   
    }else{

        //echo "validated";
        $user_p_info_id = mysql_result($query_result, 0, 'user_p_info_id');
        $_SESSION['user_p_info_id']=$user_p_info_id;
        header('Location: index.php');


}
} 
}

?>

<form action="login.php" method="POST">
<p> USERNAME : <input type="text" name="uname" /> </p>
<p> PASSWORD : <input type="password" name="password" /> </p>
<p> <input type="submit" value="LOGIN" /> </p>
</form>

然后您的注销功能将如下所示

<?php

require 'core.inc.php';
session_destroy();
header('Location: ../index.php');
?>

请注意，如果您想检查自己是否正在session ，只需设置此条件

<?php
require 'connections/connect.inc.php';
require 'connections/core.inc.php';

if(loggedin()) {
// Do something
}

?>

希望这可以帮助