PHP实现用户注册后手动审核，禁止即时登录的方法

Got it, let's walk through how to tweak your registration system to require manual admin approval before users can log in—exactly what you're looking for, no email verification hoopla, just you getting notified to review each new sign-up.

First, you'll need a way to track whether a user's account is ready to use. Add a new column to your user table, something like account_status, with possible values:

• pending (default for new registrations)
• approved (you've okayed the account)
• rejected (you've denied access)

Here's a quick SQL example to add this column (adjust for your database type):

ALTER TABLE users ADD COLUMN account_status VARCHAR(20) DEFAULT 'pending';

When a user submits their registration form:

• Save their details to the database with account_status = 'pending' (don't set them as active/verified like before)
• Immediately send an email to your admin inbox with all the info you need to review their account. Include things like:
  • Username/email they registered with
  • Registration timestamp
  • IP address (if you collect it)
  • Any custom fields they filled out (e.g., reason for signing up)
  • Direct links to approve/reject the account (more on this in step 4)

Example pseudo-code for sending the admin alert (using PHP as an example):

// After saving user to DB
$userId = $db->lastInsertId();
$approvalLink = "https://your-site.com/admin/approve.php?user_id=" . $userId . "&token=" . generateSecureToken($userId);
$rejectionLink = "https://your-site.com/admin/reject.php?user_id=" . $userId . "&token=" . generateSecureToken($userId);

$emailSubject = "New User Registration Needs Review";
$emailBody = "A new user has signed up:\n\nUsername: " . $userName . "\nEmail: " . $userEmail . "\nIP: " . $_SERVER['REMOTE_ADDR'] . "\n\nApprove: " . $approvalLink . "\nReject: " . $rejectionLink;

mail("your-admin-email@example.com", $emailSubject, $emailBody);

Modify your login script to check the account status after verifying the user's credentials:

• If account_status is approved: Let them log in as normal
• If account_status is pending: Show an error like "Your account is still pending admin approval. Please check back soon."
• If account_status is rejected: Show an error like "Your account has not been approved. Contact support if you have questions."

Example check in login logic:

// After validating username/password
$user = $db->getUserByUsername($username);
if ($user['account_status'] !== 'approved') {
    if ($user['account_status'] === 'pending') {
        $_SESSION['error'] = "Your account is pending admin approval.";
    } else {
        $_SESSION['error'] = "Your account has not been approved.";
    }
    header("Location: login.php");
    exit;
}
// Proceed with login if approved

You'll need a quick interface to manage pending accounts:

• Create an admin-only page that fetches all users with account_status = 'pending'
• For each user, display their registration details and two buttons: Approve and Reject
• When you click Approve: Update the user's account_status to approved (optionally send them a confirmation email)
• When you click Reject: Update the status to rejected (optionally send a rejection note)

Pro tip: Add a secure token to your approve/reject links (like in step 2) to prevent unauthorized changes. Generate a unique token tied to the user ID and verify it before updating the status.

• If you want to notify users when their account is approved/rejected, add a quick email trigger in the admin approval code
• Set up a cron job to auto-delete accounts that have been pending for 7+ days to keep your database clean
• For extra security, log all approval/rejection actions (who did it, when) in an audit table

内容的提问来源于stack exchange，提问作者Jerome