PHP登录表单报错：Undefined array key 'email'和'password'问题排查

问题 #

我正在开发一个基于PHP后端的登录表单，用于验证数据库用户表中的登录凭证。使用正确的账号信息登录时，代码第18、19行出现“Undefined array key 'email'和'password'”错误，数据库表中已存在对应字段，请求排查代码问题。

PHP 代码 #

<?php

session_start();

$dbHost = 'localhost';
$dbName = 'ecommerce_store';
$dbUser = 'root';
$dbPass = '';

try {
  $pdo = new PDO("mysql:host=$dbHost;dbname=$dbName", $dbUser, $dbPass);
  $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
} catch(PDOException $e) {
  echo "Connection failed: " . $e->getMessage();
  exit;
}

$email = $_POST['email'];
$password = $_POST['password'];

$stmt = $pdo->prepare("SELECT * FROM users WHERE email = :email");
$stmt->execute(['email' => $email]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);

if ($user && password_verify($password, $user['password'])) {
  // valid credentials, store user session
  $_SESSION['user'] = $user;
  echo "success";
} else {
  // invalid credentials
  echo "failure";
}

?>

JavaScript 代码 #

$(document).ready(function() {
  $('#login-form').validate({
    rules: {
      email: {
        required: true,
        email: true
      },
      password: {
        required: true
      }
    },
    messages: {
      email: {
        required: "Please enter your email address",
        email: "Please enter a valid email address"
      },
      password: {
        required: "Please enter your password"
      }
    },
    submitHandler: function(form) {
      var email = $('#email').val().trim();
      var password = $('#password').val().trim();
      
      $.ajax({
        type: "POST",
        url: "login.php",
        data: {email: email, password: password},
        success: function(response) {
          if (response === "success") {
            window.location.href = "profile.php";
          } else {
            $('#login-messages').html('<div class="alert alert-danger" role="alert">Login failed. Please check your email and password and try again.</div>');
          }
        },
        error: function() {
          $('#login-messages').html('<div class="alert alert-danger" role="alert">Error logging in. Please try again later.</div>');
        }
      });
    }
  });
});

HTML 代码 #

<!--Form registration-->


<div class="card">
  <div class="card-body">
<form id="login-form" action="login.php" method="POST">
  <div class="form-group text-center">
   <input type="email" class="form-control" id="email" placeholder="Email" name="email" required>
  </div>
  <div class="form-group text-center">
   <input type="password" class="form-control" id="password" placeholder="Password" name="password" required>
  </div>
  <button type="submit" class="btn btn-primary">Login</button>
</form>
</div>
</div>
<div id="login-messages"></div>

</body>
<!----Javascript files validation during form submission ---->
<script src="https://code.jquery.com/jquery-3.6.0.min.js"></script>
<script src="https://cdn.jsdelivr.net/jquery.validation/1.16.0/jquery.validate.min.js"></script>
<script src="js/login.js"></script>

问题排查与解决方案 #

核心原因 #

出现Undefined array key 'email'和'password'错误，本质是PHP脚本在非POST请求场景下直接访问了$_POST数组中不存在的键。比如直接在浏览器地址栏访问login.php，或者表单提交时JS出现异常导致POST数据未正常传递。

修复步骤 #

1. 限制请求类型，避免直接访问脚本
   在PHP代码开头添加判断，仅处理POST请求：

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    exit("Invalid request method");
}

2. 安全获取POST参数
   使用filter_input()替代直接访问$_POST，同时验证参数有效性：

$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
$password = filter_input(INPUT_POST, 'password');

// 参数为空或格式错误时直接返回失败
if (!$email || !$password) {
    echo "failure";
    exit;
}

3. 检查AJAX提交状态

• 打开浏览器开发者工具的「控制台」，确认jQuery和validate插件无加载报错
• 在「网络」面板查看AJAX请求的Form Data，确认email和password是否正常传递

4. 兼容原生表单提交（可选）
   在AJAX的submitHandler中添加return false;阻止默认提交，但确保PHP代码能同时兼容AJAX和原生表单提交的场景。

修复后的完整PHP代码 #

<?php

session_start();

$dbHost = 'localhost';
$dbName = 'ecommerce_store';
$dbUser = 'root';
$dbPass = '';

try {
  $pdo = new PDO("mysql:host=$dbHost;dbname=$dbName", $dbUser, $dbPass);
  $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
} catch(PDOException $e) {
  echo "Connection failed: " . $e->getMessage();
  exit;
}

// 仅处理POST请求
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    exit("Invalid request method");
}

// 安全获取并验证参数
$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
$password = filter_input(INPUT_POST, 'password');

if (!$email || !$password) {
    echo "failure";
    exit;
}

$stmt = $pdo->prepare("SELECT * FROM users WHERE email = :email");
$stmt->execute(['email' => $email]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);

if ($user && password_verify($password, $user['password'])) {
  $_SESSION['user'] = $user;
  echo "success";
} else {
  echo "failure";
}

?>

内容的提问来源于stack exchange，提问作者The01800