PHP注册页面无服务器处理且无报错，请求代码排查

Hey there, let's break down why your server-side logic isn't running and how to add proper password hashing with salt. I spotted several critical issues in your code:

1. Form Isn't Submitting to the Correct PHP Script #

Your HTML form's action points to index.html instead of create.php—this means when users submit the form, it's just loading a static HTML page, not hitting your server-side registration logic at all! That's why you see zero server-side activity and no console errors.

Fix the HTML Form Action: #

<form method="POST" action="create.php"> <!-- Changed from index.html to create.php -->
  <!-- Rest of your form fields stay the same -->
</form>

Also, you're loading jQuery twice (v1.10.2 and v1.11.1) which can cause conflicts. Remove one of the <script> tags for jQuery—stick with the newer 1.11.1 version.

2. Connect.php Has a Typo in Error Handling #

In your database connection code, you reference $conn instead of $connect in the error message. This will throw an undefined variable error if the connection fails:

Fixed Connect.php: #

<?php
if (!defined('HOST')) define("HOST", "localhost");
if (!defined('USER')) define("USER", "root");
if (!defined('PASSWORD')) define("PASSWORD", "");
if (!defined('DB')) define("DB", "socialmedia");

$connect = new mysqli(HOST, USER, PASSWORD, DB);
if ($connect->connect_error) {
  die("Connection failed: " . $connect->connect_error); // Fixed $conn to $connect
}
?>

3. Create.php Has Critical Bugs & Missing Hash/Salt Logic #

Your create.php code is truncated, but even the existing parts have bugs, plus there's no password hashing at all. Let's fix these:

Key Issues in Existing Code: #

• Username Match Logic is Reversed: You're showing an error when usernames do match—this is backwards!
• Redundant Input Checks: You already checked isset() and !empty() at the top, so the extra isset($_POST['firstName'])==0 checks are unnecessary and incorrect.
• No Password Hashing: You're not salting or hashing the password before storing it (never store plaintext passwords!).

Fixed & Completed Create.php (with Password Hashing): #

<?php
require 'connect.php';

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
  // Basic input validation (simplified from your redundant checks)
  $requiredFields = ['firstName', 'lastName', 'userName', 'reuserName', 'emailAddress', 'reemailAddress', 'password', 'rePassword'];
  foreach ($requiredFields as $field) {
    if (!isset($_POST[$field]) || trim($_POST[$field]) === '') {
      die("Please fill in all required fields.");
    }
  }

  // Validate first/last name (basic check for non-empty trimmed values)
  $firstName = trim($_POST['firstName']);
  $lastName = trim($_POST['lastName']);
  if (strlen($firstName) < 2 || strlen($lastName) < 2) {
    die("Please enter valid first and last names.");
  }

  // Validate username match
  $userName = trim($_POST['userName']);
  $reuserName = trim($_POST['reuserName']);
  if ($userName !== $reuserName) { // Fixed: Error when usernames DON'T match
    die("Usernames do not match.");
  }

  // Validate email match
  $emailAddress = trim($_POST['emailAddress']);
  $reemailAddress = trim($_POST['reemailAddress']);
  if ($emailAddress !== $reemailAddress) {
    die("Email addresses do not match.");
  }
  if (!filter_var($emailAddress, FILTER_VALIDATE_EMAIL)) {
    die("Please enter a valid email address.");
  }

  // Validate password match & length
  $password = trim($_POST['password']);
  $rePassword = trim($_POST['rePassword']);
  if ($password !== $rePassword) {
    die("Passwords do not match.");
  }
  if (strlen($password) < 8) {
    die("Password must be at least 8 characters long.");
  }

  // Hash the password with built-in salt (PHP's password_hash is secure and handles salt automatically)
  $hashedPassword = password_hash($password, PASSWORD_DEFAULT);

  // Escape data for database (prevent SQL injection)
  $firstNameEscaped = mysqli_real_escape_string($connect, $firstName);
  $lastNameEscaped = mysqli_real_escape_string($connect, $lastName);
  $fullNameEscaped = mysqli_real_escape_string($connect, "$firstName $lastName");
  $userNameEscaped = mysqli_real_escape_string($connect, $userName);
  $emailEscaped = mysqli_real_escape_string($connect, $emailAddress);

  // Insert into database (make sure your 'users' table has these columns!)
  $query = "INSERT INTO users (first_name, last_name, full_name, username, email, password) 
            VALUES ('$firstNameEscaped', '$lastNameEscaped', '$fullNameEscaped', '$userNameEscaped', '$emailEscaped', '$hashedPassword')";
  
  if (mysqli_query($connect, $query)) {
    echo "Registration successful!";
  } else {
    die("Error: " . mysqli_error($connect));
  }

  // Close connection
  mysqli_close($connect);
}
?>

Notes on Password Hashing: #

• I used password_hash() which is PHP's recommended secure method—it automatically generates a random salt and uses a strong hashing algorithm (bcrypt by default).
• To verify passwords during login, use password_verify($inputPassword, $storedHashedPassword).

4. Testing Tips #

• After fixing the form action, submit the form and check your database to see if the user is added with a hashed password.
• Enable PHP error reporting temporarily to catch hidden issues: add this at the top of create.php:

  error_reporting(E_ALL);
  ini_set('display_errors', 1);
  

内容的提问来源于stack exchange，提问作者john_doe