PHP中script标签弹窗不生效：数据库操作正常但无提示

核心问题：弹窗不显示的原因 #

• 你的代码在echo弹出提示的JS代码后，立刻调用了header("Location:add_student.php");。HTTP协议中，Location头会触发浏览器立即重定向，此时浏览器还没来得及解析并执行输出的JS代码，导致弹窗根本无法显示。
• 另外，header()函数要求在任何输出（包括echo、HTML空格、换行）之前调用，先echo JS再调用header本身不符合规范，会打乱页面执行逻辑。

修复方案 #

方案1：移除header()，完全用JS处理跳转 #

删掉PHP里的header()语句，让JS先执行弹窗，再完成页面跳转：

<?php
include("db_conn.php");

if(isset($_POST['submit'])){
    $library_id=$_POST['library_id'];
    $password=$_POST['password'];

    $sql="SELECT * FROM student_login WHERE library_id='$library_id' AND password='$password'";
    $result=mysqli_query($conn,$sql);
    $count=mysqli_num_rows($result);

    if($count==0){
        $insert="INSERT INTO student_login (library_id,password) VALUES('$library_id','$password')";
        $result1=mysqli_query($conn,$insert);
        echo '<script>
                alert("Successfully Added Into Database");
                window.location.href="add_student.php";
              </script>';
    }
    else{
        echo '<script>
                alert("ID and Password already exists");
                window.location.href="add_student.php";
              </script>';
    }
}
?>

方案2：用Session传递提示信息（更推荐，避免JS依赖） #

如果不想依赖JS实现提示，可以用Session存储提示内容，跳转到add_student.php后再显示：

1. 处理页面代码：

<?php
session_start(); // 必须放在代码最开头，不能有任何前置输出
include("db_conn.php");

if(isset($_POST['submit'])){
    $library_id=$_POST['library_id'];
    $password=$_POST['password'];

    $sql="SELECT * FROM student_login WHERE library_id='$library_id' AND password='$password'";
    $result=mysqli_query($conn,$sql);
    $count=mysqli_num_rows($result);

    if($count==0){
        $insert="INSERT INTO student_login (library_id,password) VALUES('$library_id','$password')";
        $result1=mysqli_query($conn,$insert);
        $_SESSION['alert_msg'] = "Successfully Added Into Database";
    }
    else{
        $_SESSION['alert_msg'] = "ID and Password already exists";
    }
    header("Location:add_student.php");
    exit; // 跳转后立即终止脚本，避免后续代码执行
}
?>

2. 在add_student.php开头添加提示显示代码：

<?php
session_start();
if(isset($_SESSION['alert_msg'])){
    echo '<script>alert("'.$_SESSION['alert_msg'].'");</script>';
    unset($_SESSION['alert_msg']); // 显示后清除会话变量，避免刷新重复弹出
}
?>

关键安全提醒：SQL注入与密码存储风险 #

• SQL注入漏洞：你的代码直接将用户输入拼接到SQL语句中，攻击者可构造恶意输入篡改数据库、窃取数据。必须改用预处理语句修复：

// 查询部分替换为预处理语句
$stmt = mysqli_prepare($conn, "SELECT * FROM student_login WHERE library_id=? AND password=?");
mysqli_stmt_bind_param($stmt, "ss", $library_id, $password);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
$count = mysqli_num_rows($result);

// 插入部分替换为预处理语句
$stmt = mysqli_prepare($conn, "INSERT INTO student_login (library_id,password) VALUES(?,?)");
mysqli_stmt_bind_param($stmt, "ss", $library_id, $password);
$result1 = mysqli_stmt_execute($stmt);

• 明文存储密码：绝对不能直接存储明文密码，需用password_hash()哈希后存储，验证时用password_verify()：

// 插入密码时哈希
$hashed_password = password_hash($password, PASSWORD_DEFAULT);
$stmt = mysqli_prepare($conn, "INSERT INTO student_login (library_id,password) VALUES(?,?)");
mysqli_stmt_bind_param($stmt, "ss", $library_id, $hashed_password);

// 验证密码时
$stmt = mysqli_prepare($conn, "SELECT password FROM student_login WHERE library_id=?");
mysqli_stmt_bind_param($stmt, "s", $library_id);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
$row = mysqli_fetch_assoc($result);
if($row && password_verify($password, $row['password'])){
    // 密码验证通过
}

内容的提问来源于stack exchange，提问作者SaiKaushik Sadu