MySQL未指定密码加密类型时，如何用PHP实现用户登录表单？

Hey there! Let's tackle this problem step by step. Since you already have a user registration system but didn't encrypt passwords initially, we'll need to address two key things: updating existing unencrypted passwords to secure hashes, and building a login form that properly verifies these hashes (plus ensures new users' passwords are encrypted from now on).

1. First: Update Existing Unencrypted Passwords in MySQL #

If your database already has user records with plain-text passwords, you need to convert them to secure hashes first. Otherwise, those users won't be able to log in with our new system.

Here's a quick PHP script to batch-update all existing passwords:

<?php
// Connect to your MySQL database
$host = 'localhost';
$dbname = 'your_db_name';
$username = 'your_db_user';
$password = 'your_db_password';

try {
    $pdo = new PDO("mysql:host=$host;dbname=$dbname;charset=utf8mb4", $username, $password);
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

    // Fetch all users with plain-text passwords
    $stmt = $pdo->query("SELECT id, password FROM users");
    $users = $stmt->fetchAll(PDO::FETCH_ASSOC);

    // Update each user's password with a secure hash
    foreach ($users as $user) {
        // Skip if password is already hashed (bcrypt hashes are 60 chars long)
        if (strlen($user['password']) === 60) {
            continue;
        }
        $hashedPassword = password_hash($user['password'], PASSWORD_DEFAULT);
        $updateStmt = $pdo->prepare("UPDATE users SET password = ? WHERE id = ?");
        $updateStmt->execute([$hashedPassword, $user['id']]);
    }

    echo "All plain-text passwords have been updated to secure hashes!";
} catch(PDOException $e) {
    echo "Error: " . $e->getMessage();
}
$pdo = null;
?>

Note: Run this script once, then delete or disable it (you don't want it sitting on your server). Also, make sure to back up your database first just in case!

2. Fix Your Registration Logic to Encrypt New Passwords #

From now on, every new user's password should be hashed before storing it in the database. Replace your existing password storage code with this:

<?php
// When processing a new registration:
$userPassword = $_POST['password']; // Get password from registration form
$hashedPassword = password_hash($userPassword, PASSWORD_DEFAULT);

// Insert into database using prepared statements (prevents SQL injection!)
$stmt = $pdo->prepare("INSERT INTO users (username, email, password) VALUES (?, ?, ?)");
$stmt->execute([$username, $email, $hashedPassword]);
?>

• PASSWORD_DEFAULT uses bcrypt (currently the most secure option supported by PHP), and it automatically generates a unique salt for each password—no need to handle salts manually!

3. Build the Login Form with Password Validation #

Now let's create the login form and validation logic.

Step 1: The Login Form (HTML) #

<form method="POST" action="login.php">
    <div>
        <label for="username">Username or Email:</label>
        <input type="text" id="username" name="username" required>
    </div>
    <div>
        <label for="password">Password:</label>
        <input type="password" id="password" name="password" required>
    </div>
    <button type="submit">Log In</button>
    <?php if (isset($error)) echo "<p style='color:red;'>$error</p>"; ?>
</form>

Step 2: The Login Validation Logic (PHP - login.php) #

<?php
session_start(); // Start session to keep user logged in

// Database connection (same as before)
$host = 'localhost';
$dbname = 'your_db_name';
$username = 'your_db_user';
$password = 'your_db_password';

$error = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    try {
        $pdo = new PDO("mysql:host=$host;dbname=$dbname;charset=utf8mb4", $username, $password);
        $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

        // Get user input
        $inputUsername = trim($_POST['username']);
        $inputPassword = $_POST['password'];

        // Fetch user from database (use prepared statement to prevent SQL injection)
        $stmt = $pdo->prepare("SELECT id, username, password FROM users WHERE username = ? OR email = ?");
        $stmt->execute([$inputUsername, $inputUsername]);
        $user = $stmt->fetch(PDO::FETCH_ASSOC);

        if ($user) {
            // Verify the password against the stored hash
            if (password_verify($inputPassword, $user['password'])) {
                // Password is correct - set session variables
                $_SESSION['user_id'] = $user['id'];
                $_SESSION['username'] = $user['username'];
                // Redirect to dashboard or home page
                header("Location: dashboard.php");
                exit();
            } else {
                $error = "Invalid username/email or password.";
            }
        } else {
            $error = "Invalid username/email or password.";
        }
    } catch(PDOException $e) {
        $error = "Something went wrong. Please try again later.";
        // Log the error for your own reference (don't show to users)
        error_log("Login error: " . $e->getMessage());
    }
    $pdo = null;
}
?>
<!-- Include the HTML form here, or have this file render the form -->

Key Security Notes: #

• Always use prepared statements to prevent SQL injection attacks—never concatenate user input into SQL queries.
• Don't give specific error messages (like "Username exists but password is wrong")—this can help attackers guess valid usernames.
• Use HTTPS on your website to encrypt data in transit between the user's browser and your server.
• Never store plain-text passwords—even if you think it's temporary.

内容的提问来源于stack exchange，提问作者Nkweti Infinity