PHP基于输入输出数据库数据及登录后展示指定字段的实现咨询

Hey there! Let's tackle your requirements step by step. You want a PHP workflow where users log in using their kodeDosen (primary key) and password, and after successful verification, you display all their data except the password field. Let's cover everything from registration best practices to the login logic.

1. 修正后的注册代码（加入密码安全处理） #

First, your existing registration snippet is missing password hashing—storing plain-text passwords is a huge security risk. Here's the complete, secure version:

<?php
include 'connectdb.php'; // 确保这个文件正确连接你的数据库

// 接收前端发送的JSON数据
$data = json_decode(file_get_contents('php://input'), true);

// 提取字段（添加基本输入校验）
$kodeDosen = isset($data["kodeDosen"]) ? trim($data["kodeDosen"]) : '';
$namaDosen = isset($data["namaDosen"]) ? trim($data["namaDosen"]) : '';
$email = isset($data["email"]) ? trim($data["email"]) : '';
$telepon = isset($data["telepon"]) ? trim($data["telepon"]) : '';
$password = isset($data["password"]) ? $data["password"] : '';

// 校验必填字段
if(empty($kodeDosen) || empty($namaDosen) || empty($email) || empty($password)) {
    echo json_encode(['status' => 'error', 'message' => '所有必填字段不能为空']);
    exit;
}

// 哈希密码（永远不要存储明文密码！）
$hashedPassword = password_hash($password, PASSWORD_DEFAULT);

// 使用预处理语句防止SQL注入
$sql = "INSERT INTO dosen (kodeDosen, namaDosen, email, telepon, password) VALUES (?, ?, ?, ?, ?)";
$stmt = $conn->prepare($sql);
$stmt->bind_param("sssss", $kodeDosen, $namaDosen, $email, $telepon, $hashedPassword);

if($stmt->execute()) {
    echo json_encode(['status' => 'success', 'message' => '注册成功']);
} else {
    echo json_encode(['status' => 'error', 'message' => '注册失败，请稍后重试']);
}

$stmt->close();
$conn->close();
?>

2. 登录验证与数据展示代码 #

This script handles login requests, verifies credentials, and returns the user's non-sensitive data:

<?php
session_start(); // 开启会话维持登录状态
include 'connectdb.php';

// 处理POST登录请求
if($_SERVER['REQUEST_METHOD'] === 'POST') {
    // 提取登录信息
    $kodeDosen = isset($_POST['kodeDosen']) ? trim($_POST['kodeDosen']) : '';
    $password = isset($_POST['password']) ? $_POST['password'] : '';

    if(empty($kodeDosen) || empty($password)) {
        echo "<p>*请填写完整的kodeDosen和密码</p>";
        exit;
    }

    // 用预处理语句查询用户数据
    $sql = "SELECT kodeDosen, namaDosen, email, telepon, password FROM dosen WHERE kodeDosen = ?";
    $stmt = $conn->prepare($sql);
    $stmt->bind_param("s", $kodeDosen);
    $stmt->execute();
    $result = $stmt->get_result();

    if($result->num_rows === 1) {
        $user = $result->fetch_assoc();
        
        // 验证密码（对比哈希值）
        if(password_verify($password, $user['password'])) {
            // 登录成功：移除password字段
            unset($user['password']);
            
            // 将用户信息存入会话，方便后续页面调用
            $_SESSION['user'] = $user;

            // 渲染用户信息（也可以改成JSON返回给前端）
            echo "<h2>登录成功！教师信息如下：</h2>";
            echo "<ul>";
            echo "<li><strong>Kode Dosen:</strong> " . htmlspecialchars($user['kodeDosen']) . "</li>";
            echo "<li><strong>Nama Dosen:</strong> " . htmlspecialchars($user['namaDosen']) . "</li>";
            echo "<li><strong>Email:</strong> " . htmlspecialchars($user['email']) . "</li>";
            echo "<li><strong>Telepon:</strong> " . htmlspecialchars($user['telepon']) . "</li>";
            echo "</ul>";
        } else {
            echo "<p>*kodeDosen或密码错误</p>";
        }
    } else {
        echo "<p>*不存在该kodeDosen的教师</p>";
    }

    $stmt->close();
    $conn->close();
}
?>

<!-- 内嵌的登录表单（也可以单独放在HTML页面） -->
<form method="POST">
    <div>
        <label for="kodeDosen">Kode Dosen:</label>
        <input type="text" id="kodeDosen" name="kodeDosen" required>
    </div>
    <div>
        <label for="password">密码:</label>
        <input type="password" id="password" name="password" required>
    </div>
    <button type="submit">登录</button>
</form>

3. 关键安全提醒 #

• SQL注入防护: 始终使用预处理语句，不要直接将用户输入拼接进SQL语句。
• 密码安全: 必须用password_hash()哈希密码，用password_verify()验证，绝对禁止存储明文密码。
• XSS防护: 展示用户数据时用htmlspecialchars()转义，避免跨站脚本攻击。
• 错误信息: 生产环境不要暴露数据库错误详情，用通用提示语代替。

内容的提问来源于stack exchange，提问作者quentino97