PHP登录系统优化：实现登录后显示用户全名而非用户名

问题说明 #

现有登录数据表仅包含Username和Password字段，注册页面已收集用户全名，但登录后Dashboard页面的欢迎语仅显示用户名，需要改为显示用户注册时填写的全名。

现有代码 #

登录页面（index.php）HTML部分 #

<form action="" method="POST">
    <div class="rows grid">
        
        <div class="row">
            <label for="username">User Name</label>
            <input type="text" id="username" name="userName" placeholder="Enter Username" required>
        </div>
        <!--Password-->
        <div class="row">
            <label for="password">Password</label>
            <input type="password" id="password" name="passWord" placeholder="Enter Password" required>
        </div>
        <!--Submit Button-->
        <div class="row">
            <input type="submit" id="submitBtn" name="submit" value="Login" required>
        <!--Register Link-->
            <span class="registerLink">Don't have an account? <a href="register.php">Register</a></span>
        </div>
    </div>
</form>

登录逻辑PHP代码 #

<?php
// Submit
if(isset($_POST['submit'])){ 
// Store the names, password, email, number
$userName = $_POST['userName'];
$passWord = $_POST['passWord'];
// Selecting from database
$sql = "SELECT * FROM admin WHERE 
    usernames = '$userName' AND
    passwords = '$passWord'";
// Exceute the query
$result = mysqli_query($conn, $sql);
// Count the number of the account of the same username and password
$count = mysqli_num_rows($result);
// Counts the results into arrys
$row = mysqli_fetch_assoc($result);
// Check if theres account in database
if ($count == 1){
    $_SESSION['loginMessage'] = '<span class = "success">Welcome '.$userName.'</span>';
    header('location:' .SITEURL. 'dashboard.php');
    exit(); 
}
else{
    $_SESSION['noAdmin'] = '<span class = "fail">Please check your username and password and try again.</span>';
    header('location:' .SITEURL. 'index.php');
    exit();
    }
}
?>

注册页面（register.php）HTML部分 #

<form action="" method="POST">
    <div class="rows grid">
        <!--Full Name-->
        <div class="row">
            <label for="fullname">Full Name</label>
            <input type="text" id="fullname" name="fullName" placeholder="Enter Full Name" required>
        </div>
         <!--Username-->
         <div class="row">
            <label for="username">User Name</label>
            <input type="text" id="username" name="userName" placeholder="Enter Username" required>
        </div>
         <!--Email-->
         <div class="row">
            <label for="email">Email</label>
            <input type="email" id="email" name="emaiL" placeholder="Enter Email" required>
        </div>
          <!--Mobile Number-->
          <div class="row">
            <label for="number">Mobile Number</label>
            <input type="number" id="number" name="numbeR" placeholder="Enter Mobile Number" required>
        </div>
        <!--Password-->
        <div class="row">
            <label for="password">Password</label>
            <input type="password" id="password" name="passWord" placeholder="Enter Password" required>
        </div>
        <!--Submit Button-->
        <div class="row">
            <input type="submit" id="submitBtn" name="submit" value="Register" required>
        <!--Try ko aban aban uni idelete-->
            <span class="registerLink">Have an account already? <a href="index.php">Login</a></span>
        </div>
    </div>
</form>

解决步骤 #

1. 数据库字段补充 #

给admin数据表添加存储用户全名的字段，比如fullname（字段类型设为VARCHAR，长度建议255）。同时确保注册逻辑将用户填写的fullName值插入到该字段中。

2. 修改登录逻辑代码 #

原代码存在SQL注入风险，同时未正确获取用户全名，以下是优化后的代码：

<?php
// 务必先启动Session
session_start();

if(isset($_POST['submit'])){ 
    $userName = $_POST['userName'];
    $passWord = $_POST['passWord'];

    // 使用预处理语句防止SQL注入
    $sql = "SELECT usernames, fullname FROM admin WHERE usernames = ? AND passwords = ?";
    $stmt = mysqli_prepare($conn, $sql);
    mysqli_stmt_bind_param($stmt, "ss", $userName, $passWord);
    mysqli_stmt_execute($stmt);
    $result = mysqli_stmt_get_result($stmt);
    
    if($row = mysqli_fetch_assoc($result)){
        // 将用户全名存入Session，方便Dashboard调用
        $_SESSION['user_fullname'] = $row['fullname'];
        $_SESSION['loginMessage'] = '<span class="success">Welcome '.$row['fullname'].'</span>';
        header('location:' . SITEURL . 'dashboard.php');
        exit(); 
    } else {
        $_SESSION['noAdmin'] = '<span class="fail">请检查用户名和密码后重试。</span>';
        header('location:' . SITEURL . 'index.php');
        exit();
    }
}
?>

3. Dashboard页面显示全名 #

在dashboard.php中，通过Session获取并显示用户全名：

<?php
session_start();
// 检查用户是否已登录
if(!isset($_SESSION['user_fullname'])){
    header('location:' . SITEURL . 'index.php');
    exit();
}
?>

<!-- HTML部分 -->
<div class="welcome-message">
    <?php echo $_SESSION['loginMessage']; ?>
    <!-- 或者直接输出全名 -->
    <!-- <span class="success">Welcome <?php echo $_SESSION['user_fullname']; ?></span> -->
</div>

注意事项 #

• 所有涉及Session的页面都必须先调用session_start()；
• 原代码中密码明文存储存在严重安全隐患，建议使用password_hash()和password_verify()处理密码；
• 注册逻辑需同步更新，确保fullName字段的值正确插入到数据库的fullname字段中。

内容的提问来源于stack exchange，提问作者Jedd F. Torrecampo