手动搭建PHP+Apache+MySQL环境后，如何解决登录功能相关PHP错误？

Hey there! Sounds like you’ve got a solid foundation with your manually installed LAMP stack, and building an OOP-based login system is a smart move for scalability and clean code. Let’s walk through how each of your 5 core files fits into the system, with practical OOP implementations:

First, let’s assume you’ve already created a MySQL database (e.g., user_auth) with a users table. Here’s a quick schema for reference:

CREATE TABLE users (
    id INT AUTO_INCREMENT PRIMARY KEY,
    username VARCHAR(50) NOT NULL UNIQUE,
    email VARCHAR(100) NOT NULL UNIQUE,
    password VARCHAR(255) NOT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

1. config.php – Database Connection (OOP Style) #

This file handles the database connection using PHP’s PDO (preferred over mysqli for OOP and security) and initializes sessions for the entire system. It should be included in all other files that need database access.

<?php
class Database {
    private $host = 'localhost';
    private $db_name = 'user_auth';
    private $username = 'your_db_user';
    private $password = 'your_db_password';
    public $conn;

    public function getConnection() {
        $this->conn = null;
        try {
            $this->conn = new PDO(
                "mysql:host=" . $this->host . ";dbname=" . $this->db_name,
                $this->username,
                $this->password
            );
            $this->conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
        } catch(PDOException $exception) {
            echo "Database connection error: " . $exception->getMessage();
        }
        return $this->conn;
    }
}

// Initialize session for authentication
session_start();
?>

2. register.php – User Registration Form & Logic #

This file handles new user sign-ups, validates input, hashes passwords securely, and inserts user data into the database.

<?php
require_once 'config.php';

class User {
    private $conn;
    private $table_name = 'users';

    public $id;
    public $username;
    public $email;
    public $password;

    public function __construct($db) {
        $this->conn = $db;
    }

    public function register() {
        // Prepared statement to prevent SQL injection
        $query = "INSERT INTO " . $this->table_name . " SET username=:username, email=:email, password=:password";
        $stmt = $this->conn->prepare($query);

        // Sanitize user input
        $this->username = htmlspecialchars(strip_tags($this->username));
        $this->email = htmlspecialchars(strip_tags($this->email));
        $this->password = password_hash($this->password, PASSWORD_DEFAULT); // Secure password hashing

        // Bind values to prepared statement
        $stmt->bindParam(":username", $this->username);
        $stmt->bindParam(":email", $this->email);
        $stmt->bindParam(":password", $this->password);

        return $stmt->execute();
    }
}

// Handle form submission
if($_POST) {
    $database = new Database();
    $db = $database->getConnection();
    $user = new User($db);

    $user->username = $_POST['username'];
    $user->email = $_POST['email'];
    $user->password = $_POST['password'];

    if($user->register()) {
        echo "<p>Registration successful! <a href='login.php'>Login here</a></p>";
    } else {
        echo "<p>Registration failed. Please try again.</p>";
    }
}
?>

<!-- HTML Registration Form -->
<!DOCTYPE html>
<html>
<head>
    <title>Register</title>
</head>
<body>
    <h2>Create an Account</h2>
    <form method="post">
        <label>Username:</label><br>
        <input type="text" name="username" required><br>
        <label>Email:</label><br>
        <input type="email" name="email" required><br>
        <label>Password:</label><br>
        <input type="password" name="password" required><br><br>
        <input type="submit" value="Register">
    </form>
</body>
</html>

3. login.php – User Authentication #

This file verifies user credentials against the database, starts a session if validation succeeds, and redirects to the welcome page.

<?php
require_once 'config.php';

class Auth {
    private $conn;
    private $table_name = 'users';

    public $username;
    public $password;

    public function __construct($db) {
        $this->conn = $db;
    }

    public function login() {
        $query = "SELECT id, username, password FROM " . $this->table_name . " WHERE username = :username LIMIT 1";
        $stmt = $this->conn->prepare($query);

        $this->username = htmlspecialchars(strip_tags($this->username));
        $stmt->bindParam(":username", $this->username);
        $stmt->execute();

        $row = $stmt->fetch(PDO::FETCH_ASSOC);
        // Verify password hash and set session variables
        if($row && password_verify($this->password, $row['password'])) {
            $_SESSION['user_id'] = $row['id'];
            $_SESSION['username'] = $row['username'];
            return true;
        }
        return false;
    }
}

// Redirect logged-in users to welcome page
if(isset($_SESSION['user_id'])) {
    header("Location: welcome.php");
    exit;
}

// Handle login submission
if($_POST) {
    $database = new Database();
    $db = $database->getConnection();
    $auth = new Auth($db);

    $auth->username = $_POST['username'];
    $auth->password = $_POST['password'];

    if($auth->login()) {
        header("Location: welcome.php");
        exit;
    } else {
        echo "<p>Invalid username or password!</p>";
    }
}
?>

<!-- HTML Login Form -->
<!DOCTYPE html>
<html>
<head>
    <title>Login</title>
</head>
<body>
    <h2>Login to Your Account</h2>
    <form method="post">
        <label>Username:</label><br>
        <input type="text" name="username" required><br>
        <label>Password:</label><br>
        <input type="password" name="password" required><br><br>
        <input type="submit" value="Login">
        <p>Don't have an account? <a href="register.php">Register here</a></p>
    </form>
</body>
</html>

4. welcome.php – Post-Login Landing Page #

This page checks if the user is logged in (via session) and displays a personalized welcome message. If not logged in, it redirects to the login page.

<?php
require_once 'config.php';

// Redirect unauthenticated users to login
if(!isset($_SESSION['user_id'])) {
    header("Location: login.php");
    exit;
}
?>

<!DOCTYPE html>
<html>
<head>
    <title>Welcome</title>
</head>
<body>
    <h2>Welcome, <?php echo $_SESSION['username']; ?>!</h2>
    <p>You've successfully logged into your account.</p>
    <p><a href="logout.php">Logout</a></p>
</body>
</html>

5. logout.php – Session Termination #

This file destroys the user’s session and redirects them back to the login page.

<?php
require_once 'config.php';

// Clear all session data
session_unset();
session_destroy();

// Redirect to login page
header("Location: login.php");
exit;
?>

Quick Security Tips to Harden Your System #

• Stick with prepared statements: They’re the best defense against SQL injection attacks.
• Avoid password reuse: Encourage users to create unique passwords, and never store plaintext passwords (we use password_hash() for this).
• Secure sessions: Update your php.ini to set session.cookie_secure = On and session.cookie_httponly = On to prevent session hijacking.
• Add input validation: Extend the registration/login forms to check for password strength, valid email formats, and username length.

内容的提问来源于stack exchange，提问作者James