Home > Article > Backend Development > PHP user login verification module

PHP user login verification module

不言Original: 2018-05-15 17:37:2122413browse

The content of this article is about the PHP user login verification module, which has certain reference value. Now I share it with everyone. Friends in need can refer to it

realizing user login

>>>1 Create a login form

The HTML code of the login form is as follows:

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<title>User Login</title>
<style type="text/css">
<!—
.alert {color: red}
.textinput {width:160px}
.btn {width:80px}
table {border: 3px double;background-color:#eeeeee;}
-->
</style>

</head>
<body>
<form name="frmLogin" method="post" action="login.php" onSubmit="return doCheck();"> <table border="0" cellpadding="8" width="350" align="center">
<tr><td colspan="2" align="center" class="alert"></td></tr>
用户名：
<td><input name="username" type="text" id="username" class="textinput" /></td> </tr>
<tr><td>密码：</td>
<td><input name="pwd" type="password" id="password" class="textinput" /></td> </tr>
<tr><td colspan="2" align="center">
<input type="submit" class="btn" value="登录">  
<input type="reset" class="btn" value="重置">
</td>
</tr>
</form>
</body>
</html>

Save the above code as login.php file and run it in the browser.

>>>2 Verify login name and password

After the user enters the login information in the login form, the data is submitted back to this page login. PHP is used for processing. Next, add the code to verify whether the username and password are correct in the header of login.php. login.php code changes are as follows:

<br/>

<?php
require_once(&#39;common.php&#39;); // 引入公共文件，其中实现了SQL注入漏洞检查的代码 $username = trim($_POST[&#39;username&#39;]);
// 取得客户端提交的密码并用md5()函数时行加密转换以便后面的验证
$pwd = md5($_POST[&#39;pwd&#39;]);
// 设置一个错误消息变量，以便判断是否有错误发生
// 以及在客户端显示错误消息。 其初值为空
$errmsg = &#39;&#39;;
if (!empty($username)) { // 用户填写了数据才执行数据库操作
//---------------------------------------------------------
// 数据验证, empty()函数判断变量内容是否为空
if (empty($username)) {
$errmsg = &#39;数据输入不完整&#39;;
}
//---------------------------------------------------------
if(empty($errmsg)) { // $errmsg为空说明前面的验证通过
// 调用mysqli的构造函数建立连接，同时选择使用数据库&#39;test&#39;
$db = @new mysqli("127.0.0.1", "developer", "123456", "test");
// 检查数据库连接
if (mysqli_connect_errno()) {
$errmsg = "数据库连接失败!
\n";
}
else {
// 查询数据库，看用户名及密码是否正确
$sql = "SELECT * FROM t_user WHERE f_username=&#39;$username&#39; AND f_password=&#39;$pwd&#39;";
$rs = $db->query($sql);
// $rs->num_rows判断上面的执行结果是否含有记录，有记录说明登录成功 if ($rs && $rs->num_rows > 0) {
// 在实际应用中可以使用前面提到的重定向功能转到主页
$errmsg = "登录成功!";
}
else {
$errmsg = "用户名或密码不正确，登录失败!";
}

// 关闭数据库连接
$db->close();
}
}
}
?>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<title>User Login</title>
<style type="text/css">
<!--
.alert {color: red}
.textinput {width:160px}
.btn {width:80px}
table {border: 3px double;background-color:#eeeeee;}
-->
</style>

</head>
<body>
<form name="frmLogin" method="post" action="login.php" onSubmit="return doCheck();">
<table border="0" cellpadding="8" width="350" align="center">
<tr><td colspan="2" align="center" class="alert"><?echo $errmsg;?></td></tr>
用户名：
<td><input name="username" type="text" id="username" class="textinput" value="<?echo $username;?>" /></td>
</tr>
<tr><td>密码：</td>
<td><input name="pwd" type="password" id="password" class="textinput" /></td> </tr>
<tr><td colspan="2" align="center">
<input type="submit" class="btn" value="登录">  
<input type="reset" class="btn" value="重置">
</td>
</tr>
</form>
</body>
</html>

The part shown in bold is the newly added code, and most of the statements have been commented in detail. It is worth noting the code added in the HTML form. PHP code is added to the cell in the first row to output errors or prompts that may occur during server-side processing. In addition, the value attribute is marked in the user name input box. Added PHP code to output the last submitted username, so that users who cannot log in because they entered the wrong password only need to enter their password when trying again.
Run login.php again and enter data in the form to try to log in.

>>>3 Update user login information

In the user information table t_user, the f_logintimes field is used to record the user's login times, and the f_lasttime field is used to record the user's last login time The login time and the f_login field are used to record the IP used by the user for the last login. Recording this information in the database is mainly to provide management with the convenience of counting the number of user logins and the geographical distribution of users. These data must be updated every time the user logs in. Next, add the code to update these data.
Open the login.php file and change the PHP code in its header as follows:

<?php
......
if ($rs && $rs->num_rows > 0) {
// 在实际应用中可以使用前面提到的重定向功能转到主页
第4 / 6页
$errmsg = "登录成功!";

// 更新用户登录信息
$ip = $_SERVER[&#39;REMOTE_ADDR&#39;]; // 获取客户端的IP
$sql = "UPDATE t_user SET f_logintimes = f_logintimes + 1,";
$sql .= "f_lasttime=now(), f_loginip=&#39;$ip&#39; ";
$sql .= " WHERE f_username=&#39;$username&#39;";
$db->query($sql);
}
else {
$errmsg = "用户名或密码不正确，登录失败!";
}
......
?>

The bolded part above is the newly added code. The code first starts with automatic Obtain the client's IP address from the global variable $_SERVER, then construct a SQL statement and execute the statement to update the user's login information. It is worth noting that the assignment of f_lasttime in this SQL statement is achieved by calling MySQL's internal function now(). MySQL's now() function returns the current time on the server.

>>>4 Use Session to save user information

HTTP protocol is stateless. All it does is simply send a request to the server and get data from the server; it knows nothing else, and even if the same PHP file is requested twice, it will not think that there is any connection between the two requests.
Due to the stateless nature of the HTTP protocol, it is impossible to share information between two different requests, such as recording "current visitor" information. Although the user's username and password have been verified to be correct during the login process, when the user jumps to other pages, all user information obtained from the login page is lost, which is something the user does not want to happen. At the same time, it is unrealistic to require users to enter their username and password for verification when entering each page, which requires that information can be shared between different pages.
Generally speaking, for PHP and other Web programming languages, you can use Cookie or Session to solve this problem.
Cookie is a small file saved on the client. Some information that needs to be shared between pages can be stored in this file. However, Cookies have three disadvantages: first, the size cannot exceed 4KB (different browsers may have different restrictions); second, users can disable Cookies in browser settings; third, Cookies record data on the client, which is less secure. Session is generally implemented through Cookie. If the user disables Cookie, Session will also be invalid. Different from Cookie, Session only puts the identification of an information on the client through Cookie but the actual information is stored on the server, which greatly improves the security performance. Now there is another way to use Session without cookies, that is, URL rewriting technology. This method uses the Session identifier as a parameter of the URL to interact with the service. The advantage is that it is not restricted by the client's cookie disabling, but the disadvantage is that it is more troublesome to use.
Using Session in PHP is very simple. PHP provides an automatic global variable $_SESSION for handling Session. However, it should be noted that if there is no setting to automatically start the Session in the PHP configuration file, you must call the session_start() function to start the Session before using the Session.
Open login.php again and add the following code in bold to record user information.

<?php

......
if ($rs && $rs->num_rows > 0) {
// 使用session保存当前用户
session_start();
$_SESSION[&#39;uid&#39;] = $username;

// 在实际应用中可以使用前面提到的重定向功能转到主页
$errmsg = "登录成功!";

// 更新用户登录信息
$ip = $_SERVER[&#39;REMOTE_ADDR&#39;]; // 获取客户端的IP
$sql = "UPDATE t_user SET f_logintimes = f_logintimes + 1,";
$sql .= "f_lasttime=now(), f_loginip=&#39;$ip&#39; ";
$sql .= " WHERE f_username=&#39;$username&#39;";
$db->query($sql);
}
......
?>

Don’t abuse Session. The biggest role of Session is to maintain state between pages. After many beginners master Session technology, it is easy for them to use Session as a magic weapon for storing data and place a lot of data in Session. Since this data will not be released until the Session expires, it will put a lot of burden on the server.

Determine whether the user has logged in

Since the previous section has completed the work of saving the user name to the Session, it is very simple to determine whether the user has logged in. The code is as follows:

<?php
session_start();
if (empty($_SESSION[&#39;uid&#39;])) {
echo "您还没有登录，不能访问当前页面！";
exit;
}
?>

通过判断自动全局变$_SESSION中的uid是否为空，就可以判断用户是否已经登录。如果用户没有登录，就提示其无法访问当前页面，并终止程序的运行（或者使用一条重定向语句将页面导向登录页）。