PHP注册页面问题求助：registo.php报Error500或空白页

First off, let's tackle that frustrating 500 error (Chrome) or blank page (Firefox)—this is almost always due to a hidden PHP error your server is suppressing. Let's start with debugging, then fix the form logic, and finally add the critical security checks you're missing.

Step 1: Uncover the Root Cause of the 500 Error #

Without seeing the actual error message, we're guessing in the dark. Enable PHP error display temporarily (turn this off in production!) by adding these lines at the very top of registo.php:

error_reporting(E_ALL);
ini_set('display_errors', 1);

Now refresh the page—you'll see exactly what's breaking things (common culprits: syntax typos, missing database credentials, unopened PHP tags, or missing extensions like mysqli/PDO).

Other quick checks for the 500 error:

• File permissions: Ensure registo.php and signup.php have permissions set to 644, and their parent directory is 755 (server needs read access).
• Database connection: If your code connects to a database, double-check the hostname, username, password, and database name—typos here are a frequent cause of silent failures.
• Include/Require paths: If registo.php uses include('signup.php') or require, confirm the file path is correct (relative paths can break if you're accessing the file from a subdirectory).

Step 2: Fix the Form Load/Submission Logic #

You mentioned using isset to handle direct access vs form submission—here's a clean, working example of that logic, including basic error handling:

<?php
// Debug mode (disable in production)
error_reporting(E_ALL);
ini_set('display_errors', 1);

// Initialize database connection (use mysqli or PDO—avoid old mysql_* functions)
$db_host = 'localhost';
$db_user = 'your_db_user';
$db_pass = 'your_db_password';
$db_name = 'your_db_name';

$conn = mysqli_connect($db_host, $db_user, $db_pass, $db_name);
if (!$conn) {
    die("Database connection failed: " . mysqli_connect_error());
}

// Handle form submission
if (isset($_POST['submit_registration'])) {
    // Sanitize and validate input first
    $username = trim($_POST['username']);
    $email = trim($_POST['email']);
    $password = $_POST['password'];

    // Basic required field check
    if (empty($username) || empty($email) || empty($password)) {
        $error = "All fields are required!";
    } else {
        // We'll add secure database insertion here next
        // For now, just confirm submission works
        echo "Form submitted successfully! Now let's add secure DB logic.";
    }
}
?>

<!-- Registration Form (shows when not submitting) -->
<!DOCTYPE html>
<html>
<head>
    <title>Register</title>
</head>
<body>
    <?php if (isset($error)) echo "<p style='color: red;'>$error</p>"; ?>
    <form method="POST" action="registo.php">
        <label>Username: </label>
        <input type="text" name="username" required><br>
        
        <label>Email: </label>
        <input type="email" name="email" required><br>
        
        <label>Password: </label>
        <input type="password" name="password" required><br>
        
        <button type="submit" name="submit_registration">Register</button>
    </form>
</body>
</html>

Key notes here:

• The form's action points directly to registo.php (or you can leave it empty for self-submission).
• The submit button has a clear name attribute (submit_registration) so the isset check works reliably.
• We're using trim() to clean up extra whitespace from user input.

Step 3: Add Critical Security Checks #

You mentioned missing basic security—here are the non-negotiable fixes to protect your system:

1. Never Store Plaintext Passwords #

Use PHP's built-in password_hash() function to hash passwords before storing them:

// Replace the placeholder echo with this secure insertion code
$hashed_password = password_hash($password, PASSWORD_DEFAULT);

// Use prepared statements to prevent SQL injection
$stmt = mysqli_prepare($conn, "INSERT INTO users (username, email, password) VALUES (?, ?, ?)");
mysqli_stmt_bind_param($stmt, "sss", $username, $email, $hashed_password);

if (mysqli_stmt_execute($stmt)) {
    echo "Registration successful!";
} else {
    $error = "Registration failed: " . mysqli_error($conn);
}

mysqli_stmt_close($stmt);

Prepared statements eliminate SQL injection risks—never concatenate user input directly into SQL queries.

2. Validate Input Format #

• For usernames: Restrict to allowed characters (e.g., letters, numbers, underscores) with preg_match:

  if (!preg_match("/^[a-zA-Z0-9_]{3,20}$/", $username)) {
      $error = "Username must be 3-20 characters long and only contain letters, numbers, or underscores.";
  }
  

• For emails: Use PHP's filter_var to validate format:

  if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
      $error = "Please enter a valid email address.";
  }
  

• For passwords: Enforce minimum length (e.g., 8 characters) and complexity if needed:

  if (strlen($password) < 8) {
      $error = "Password must be at least 8 characters long.";
  }
  

3. Prevent XSS Attacks #

When displaying user input (e.g., showing a welcome message after registration), use htmlspecialchars() to escape dangerous characters:

echo "Welcome, " . htmlspecialchars($username) . "!";

4. Add CSRF Protection #

Prevent cross-site request forgery by adding a CSRF token to your form:

// Start the session (must be at the top of the file, before any output)
session_start();

// Generate a CSRF token if one doesn't exist
if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}

// Add the token to your form
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token']; ?>">

// Validate the token on submission
if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    die("Invalid request. Please try again.");
}

Step 4: Verify signup.php Integration #

If registo.php relies on code from signup.php:

• Double-check that your include/require path is correct (e.g., require_once('signup.php') if it's in the same directory).
• Run signup.php directly to ensure it doesn't have its own syntax errors—any error in an included file will crash registo.php.

Once you've worked through these steps, your 500 error should be gone, your form should submit data to the database safely, and you'll have basic security in place.

内容的提问来源于stack exchange，提问作者Gabriel Silva