如何为单个用户设置多密码（四组）保护PHP页面？

Got it, let's solve this exactly how you need it—one user, four valid passwords to access your protected PHP page. The key here is adapting the "password array" approach but tailoring it strictly for a single user, with proper security practices (no plaintext passwords, please!).

Step 1: Store Hashed Passwords (Critical for Security) #

First, never store plaintext passwords. Use PHP's built-in password_hash() function to generate secure hashes for each of your four passwords. You can run this once in a test script to get the hashes, then save them in a secure config file (outside your web root if possible).

Example to generate hashes:

// Run this once, then copy the output hashes to your config
$passwords = ['pass1', 'pass2', 'pass3', 'pass4'];
foreach ($passwords as $pass) {
    echo password_hash($pass, PASSWORD_DEFAULT) . "\n";
}

Step 2: Build the Login & Validation Logic #

Create a login form, then check if the submitted password matches any of the hashed passwords in your array. If it does, start a session to keep the user authenticated.

Here's a complete example:

Login Page (login.php)

<?php
session_start();

// If user is already logged in, redirect to protected page
if (isset($_SESSION['authenticated'])) {
    header('Location: protected-page.php');
    exit;
}

$error = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Your pre-generated hashed passwords (from Step 1)
    $valid_hashes = [
        '$2y$10$exampleHash1ForPass1',
        '$2y$10$exampleHash2ForPass2',
        '$2y$10$exampleHash3ForPass3',
        '$2y$10$exampleHash4ForPass4'
    ];

    $submitted_password = $_POST['password'] ?? '';

    // Check if submitted password matches any hash
    $is_valid = false;
    foreach ($valid_hashes as $hash) {
        if (password_verify($submitted_password, $hash)) {
            $is_valid = true;
            break;
        }
    }

    if ($is_valid) {
        $_SESSION['authenticated'] = true;
        header('Location: protected-page.php');
        exit;
    } else {
        $error = 'Invalid password. Please try again.';
    }
}
?>

<!DOCTYPE html>
<html>
<head>
    <title>Login</title>
</head>
<body>
    <?php if ($error): ?>
        <p style="color: red;"><?php echo $error; ?></p>
    <?php endif; ?>
    <form method="POST">
        <label for="password">Enter Password:</label>
        <input type="password" id="password" name="password" required>
        <button type="submit">Access Page</button>
    </form>
</body>
</html>

Protected Page (protected-page.php)

<?php
session_start();

// Check if user is authenticated
if (!isset($_SESSION['authenticated'])) {
    header('Location: login.php');
    exit;
}
?>

<!DOCTYPE html>
<html>
<head>
    <title>Protected Content</title>
</head>
<body>
    <h1>Welcome! You've accessed the protected page.</h1>
    <!-- Your protected content here -->
    <p><a href="logout.php">Log Out</a></p>
</body>
</html>

Logout Page (logout.php)

<?php
session_start();
session_destroy();
header('Location: login.php');
exit;
?>

Key Security Notes #

• HTTPS Always: Make sure your site uses HTTPS to encrypt password data in transit.
• Secure Session Settings: Configure PHP sessions with secure flags (e.g., session.cookie_secure = On in php.ini) to prevent session hijacking.
• Store Hashes Securely: Keep your $valid_hashes array in a file outside your web root (e.g., ../config.php) and include it instead of hardcoding, so it's not accessible via the browser.
• Limit Login Attempts: Add a rate limiter (e.g., track failed attempts in a session or database) to prevent brute-force attacks.

This approach works perfectly for your use case: one user, four valid passwords, and it's secure enough for most applications.

内容的提问来源于stack exchange，提问作者Aliu