PHP用户注册与登录系统：解决变量冲突与安全实践

// signupp.php (原始问题代码片段)
if (isset($_POST["submit"])) {
    $name = $_POST["namee"];
    $email = $_POST["emaill"];
    $username = $_POST["userme"]; // 用户输入的用户名
    $password = $_POST["passme"]; // 用户输入的密码

    require_once 'db.php'; // 在这里包含了db.php
    require_once 'functions.php';

    createUser($conn, $name, $email, $username, $password);
}

// db.php
<?php
$servername = "localhost";
$username = "root"; // 数据库用户名
$password = "password"; // 数据库密码
$dbname = "phpshop";

// Create connection
$conn = mysqli_connect($servername, $username, $password, $dbname);
// ...

// functions.php (原始问题代码片段 - loginUser部分)
function loginUser($conn, $userme, $passme) {
    $passHashed = ["passme"]; // 错误：将字符串字面量作为数组
    $checkPwd = password_verify($passme, "passme"); // 错误：将用户输入密码与字符串"passme"比较

    if ($checkPwd === false) {
        echo "<script>window.location.href='signup.php';</script>";
        exit();
    }
    else if ($checkPwd === true) {
        session_start();
        $_SESSION["userme"] = $passme["userme"]; // 错误：$passme是字符串，不能作为数组访问
        echo "<script>window.location.href='index.php';</script>";
        exit();
    }
}

// signup.php (原始问题代码片段)
<?php
include_once 'index.php'; // 包含完整的HTML结构
?>

<h2>Sign Up</h2>
<form action="signupp.php" method="post">
    <!-- ... -->
</form>

<?php
session_start(); // 确保会话在任何输出之前启动

if (isset($_POST["submit"])) {
    // 使用不同的变量名存储用户输入，避免与db.php中的变量冲突
    $inputName = $_POST["namee"];
    $inputEmail = $_POST["emaill"];
    $inputUsername = $_POST["userme"];
    $inputPassword = $_POST["passme"];

    require_once 'db.php';
    require_once 'functions.php';

    // 调用createUser函数时传入用户输入
    createUser($conn, $inputName, $inputEmail, $inputUsername, $inputPassword);
} else {
    // 如果没有通过POST请求提交，则重定向回注册页面
    header("location: signup.php");
    exit();
}

<?php

// 用户注册函数
function createUser($conn, $name, $email, $username, $password) {
    // 验证输入是否为空 (此处可添加更多验证逻辑)
    if (empty($name) || empty($email) || empty($username) || empty($password)) {
        header("location: signup.php?error=emptyinput");
        exit();
    }

    // 检查用户名是否已存在 (避免重复注册)
    if (usernameExists($conn, $username)) {
        header("location: signup.php?error=usernametaken");
        exit();
    }

    // 使用预处理语句防止SQL注入
    $sql = "INSERT INTO GuestsLogs (namee, emaill, userme, passme) VALUES (?, ?, ?, ?);";
    $stmt = mysqli_stmt_init($conn);

    if (!mysqli_stmt_prepare($stmt, $sql)) {
        // 预处理失败，记录错误并重定向
        header("location: signup.php?error=stmtfailed");
        exit();
    }

    // 对密码进行哈希处理
    $hashedPwd = password_hash($password, PASSWORD_DEFAULT);

    // 绑定参数并执行
    mysqli_stmt_bind_param($stmt, "ssss", $name, $email, $username, $hashedPwd);
    mysqli_stmt_execute($stmt);
    mysqli_stmt_close($stmt);

    // 注册成功，重定向到登录页面或成功页面
    header("location: login.php?signup=success");
    exit();
}

// 辅助函数：检查用户名是否存在
function usernameExists($conn, $username) {
    $sql = "SELECT userme FROM GuestsLogs WHERE userme = ?;";
    $stmt = mysqli_stmt_init($conn);
    if (!mysqli_stmt_prepare($stmt, $sql)) {
        header("location: signup.php?error=stmtfailed");
        exit();
    }
    mysqli_stmt_bind_param($stmt, "s", $username);
    mysqli_stmt_execute($stmt);
    $resultData = mysqli_stmt_get_result($stmt);

    if (mysqli_fetch_assoc($resultData)) {
        return true; // 用户名已存在
    } else {
        return false; // 用户名不存在
    }
    mysqli_stmt_close($stmt);
}


// 用户登录函数
function loginUser($conn, $username, $password) {
    // 验证输入是否为空
    if (empty($username) || empty($password)) {
        header("location: login.php?error=emptyinput");
        exit();
    }

    // 查找用户是否存在
    $sql = "SELECT * FROM GuestsLogs WHERE userme = ?;";
    $stmt = mysqli_stmt_init($conn);
    if (!mysqli_stmt_prepare($stmt, $sql)) {
        header("location: login.php?error=stmtfailed");
        exit();
    }
    mysqli_stmt_bind_param($stmt, "s", $username);
    mysqli_stmt_execute($stmt);

    $resultData = mysqli_stmt_get_result($stmt);

    if ($row = mysqli_fetch_assoc($resultData)) {
        // 用户存在，获取存储的哈希密码
        $pwdHashedInDb = $row["passme"];
        // 验证用户输入的密码与数据库中的哈希密码是否匹配
        $checkPwd = password_verify($password, $pwdHashedInDb);

        if ($checkPwd === false) {
            // 密码不匹配
            header("location: login.php?error=wronglogin");
            exit();
        } else if ($checkPwd === true) {
            // 密码匹配，开始会话
            session_start(); // 确保会话已启动
            $_SESSION["userid"] = $row["id"]; // 假设GuestsLogs表有一个'id'列
            $_SESSION["userme"] = $row["userme"];
            header("location: index.php?login=success");
            exit();