Ubuntu PHP如何实现用户认证与授权

在Ubuntu上使用PHP实现用户认证与授权，通常涉及以下几个步骤：

安装必要的软件包：确保你的Ubuntu系统上已经安装了Apache或Nginx、PHP以及数据库（如MySQL或PostgreSQL）。
```
sudo apt update
sudo apt install apache2 php libapache2-mod-php php-mysql
```

创建数据库和用户表：使用MySQL或PostgreSQL创建一个数据库，并在其中创建一个用户表来存储用户信息。

CREATE DATABASE user_db;
USE user_db;

CREATE TABLE users (
    id INT AUTO_INCREMENT PRIMARY KEY,
    username VARCHAR(50) NOT NULL UNIQUE,
    password VARCHAR(255) NOT NULL,
    email VARCHAR(100) NOT NULL UNIQUE
);

注册用户：创建一个PHP脚本来处理用户注册。这个脚本将接收用户输入的数据，将其存储在数据库中，并使用密码哈希函数（如password_hash）来安全地存储密码。

<?php
// register.php
$servername = "localhost";
$username = "your_db_username";
$password = "your_db_password";
$dbname = "user_db";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $username = $_POST['username'];
    $password = password_hash($_POST['password'], PASSWORD_DEFAULT);
    $email = $_POST['email'];

    $sql = "INSERT INTO users (username, password, email) VALUES (?, ?, ?)";
    $stmt = $conn->prepare($sql);
    $stmt->bind_param("sss", $username, $password, $email);

    if ($stmt->execute()) {
        echo "New record created successfully";
    } else {
        echo "Error: " . $sql . "<br>" . $conn->error;
    }

    $stmt->close();
    $conn->close();
}
?>

<!DOCTYPE html>
<html>
<head>
    <title>Register</title>
</head>
<body>
    <form action="register.php" method="post">
        Username: <input type="text" name="username"><br>
        Password: <input type="password" name="password"><br>
        Email: <input type="email" name="email"><br>
        <input type="submit" value="Register">
    </form>
</body>
</html>

用户登录：创建一个PHP脚本来处理用户登录。这个脚本将验证用户输入的用户名和密码是否匹配数据库中的记录。

<?php
// login.php
session_start();

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $username = $_POST['username'];
    $password = $_POST['password'];

    $servername = "localhost";
    $username_db = "your_db_username";
    $password_db = "your_db_password";
    $dbname = "user_db";

    // Create connection
    $conn = new mysqli($servername, $username_db, $password_db, $dbname);

    // Check connection
    if ($conn->connect_error) {
        die("Connection failed: " . $conn->connect_error);
    }

    $sql = "SELECT id, username, password FROM users WHERE username = ?";
    $stmt = $conn->prepare($sql);
    $stmt->bind_param("s", $username);
    $stmt->execute();
    $result = $stmt->get_result();

    if ($result->num_rows > 0) {
        $user = $result->fetch_assoc();
        if (password_verify($password, $user['password'])) {
            $_SESSION['loggedin'] = true;
            $_SESSION['id'] = $user['id'];
            $_SESSION['username'] = $user['username'];
            header("Location: welcome.php");
            exit;
        } else {
            echo "Invalid username or password.";
        }
    } else {
        echo "Invalid username or password.";
    }

    $stmt->close();
    $conn->close();
}
?>

<!DOCTYPE html>
<html>
<head>
    <title>Login</title>
</head>
<body>
    <form action="login.php" method="post">
        Username: <input type="text" name="username"><br>
        Password: <input type="password" name="password"><br>
        <input type="submit" value="Login">
    </form>
</body>
</html>

授权：创建一个中间件或装饰器来检查用户是否已登录，并根据用户的角色或权限来限制访问某些页面或功能。

<?php
// auth.php
session_start();

function isLoggedIn() {
    return isset($_SESSION['loggedin']) && $_SESSION['loggedin'] === true;
}

function redirect($url) {
    header("Location: " . $url);
    exit;
}

if (!isLoggedIn()) {
    redirect("login.php");
}
?>

<!DOCTYPE html>
<html>
<head>
    <title>Welcome</title>
</head>
<body>
    Welcome, <?php echo htmlspecialchars($_SESSION['username']); ?>!
    <a href="logout.php">Logout</a>
</body>
</html>

注销：创建一个PHP脚本来处理用户注销，清除会话数据并重定向到登录页面。
```
<?php
// logout.php
session_start();
session_destroy();
header("Location: login.php");
exit;
```

通过以上步骤，你可以在Ubuntu上使用PHP实现基本的用户认证与授权功能。根据具体需求，你可能还需要添加更多的安全措施，如CSRF保护、输入验证和错误处理等。

最新问答

相关标签