PHP实现用户权限验证登录
目前，大多数网站均支持用户登录注册功能，而做管理员和普通成员登录验证的网站少之又少，基本上一个网站的后台管理地址和前端页面是分开的，管理员和普通成员也是分开的，这也是基于安全考虑，而小编今天将管理员和普通员整合在一起，实现登录时正确的权限验证和登录后正确的权限页面显示。
数据表设计
其中rule字段的值对应前端页面的单选框的value值。rulename仅作为用户权限标识。
user表
-- phpMyAdmin SQL Dump
-- version 4.9.1
-- https://www.phpmyadmin.net/
--
-- 主机： localhost
-- 生成日期： 2021-02-16 13:31:46
-- 服务器版本： 8.0.17
-- PHP 版本： 7.3.10
SET SQL_MODE = "NO_AUTO_VALUE_ON_ZERO";
SET AUTOCOMMIT = 0;
START TRANSACTION;
SET time_zone = "+00:00";
/*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;
/*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;
/*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;
/*!40101 SET NAMES utf8mb4 */;
--
-- 数据库： `news`
--
-- --------------------------------------------------------
--
-- 表的结构 `user`
--
CREATE TABLE `user` (
`id` int(11) NOT NULL,
`account` varchar(50) NOT NULL,
`password` varchar(66) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL,
`mesg` varchar(50) NOT NULL,
`name` varchar(50) NOT NULL,
`truename` varchar(20) NOT NULL,
`sex` varchar(10) NOT NULL,
`birthdar` varchar(50) NOT NULL,
`phone` varchar(20) NOT NULL,
`email` varchar(50) NOT NULL,
`QQ` varchar(20) NOT NULL,
`wechat` varchar(36) NOT NULL,
`province` varchar(10) NOT NULL,
`country` varchar(10) NOT NULL,
`city` varchar(10) NOT NULL,
`ditel` varchar(50) NOT NULL,
`regtime` varchar(50) NOT NULL,
`regip` varchar(36) NOT NULL,
`regaction` varchar(100) NOT NULL,
`rule` varchar(1) NOT NULL,
`rulename` varchar(10) NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
--
-- 转存表中的数据 `user`
--
INSERT INTO `user` (`id`, `account`, `password`, `mesg`, `name`, `truename`, `sex`, `birthdar`, `phone`, `email`, `QQ`, `wechat`, `province`, `country`, `city`, `ditel`, `regtime`, `regip`, `regaction`, `rule`, `rulename`) VALUES
(23, '110011', 'b831e9f42e8c8ea9be39bd33f7906800', '我是普通成员，拥有一般操作权限。', '普通成员', '普通成员1', '保密', '2021-01-16', '18097654789', 'public@126.com', 'public', 'public', '广东', '深圳', '罗湖区', '客户端', '2020-02-10 21:17:02', '127.0.0.1', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3970.5 ', '0', '普通成员'),
(27, '220022', 'dacd8bf36c6780b5e2a4d0266544df7d', '我是管理员，我拥有最高权限！！！', 'Root', '管理员1', '保密', '2021-01-04', '13658595458', 'root@sadsa.com', 'root', 'root', '北京', '北京', '东城区', '服务器', '2021-01-07 20:19:31', '127.0.0.1', 'Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0', '1', '管理员'),
(28, '120021', 'c9c8b9e78db383ff635adccbb470be7c', '我是普通用户1，我拥有一般权限！', '普通用户1', '普通用户1', '男', '2021-01-18', 'public', 'public@root.com', 'public', 'pubic', '广东', '广州', '天河区', '岗顶科技中心', '2021-01-18 09:20:35', '127.0.0.1', 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko', '0', '普通成员');
--
-- 转储表的索引
--
--
-- 表的索引 `user`
--
ALTER TABLE `user`
ADD PRIMARY KEY (`id`);
--
-- 在导出的表使用AUTO_INCREMENT
--
--
-- 使用表AUTO_INCREMENT `user`
--
ALTER TABLE `user`
MODIFY `id` int(11) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=30;
COMMIT;
/*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */;
/*!40101 SET CHARACTER_SET_RESULTS=@OLD_CHARACTER_SET_RESULTS */;
/*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;
后端连接mysql数据库conn.php
<?php
$link = mysqli_connect('localhost','root','123123');
if(!$link){
echo "数据库连接失败！</br>";
}
mysqli_set_charset($link,'utf8');
mysqli_select_db($link,'news');
//mysqli_close($link);
?>
前端登录页面login.php
<!doctype html>
<html>
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1.0,user-scalable=false"/>
<meta http-equiv="X-UA-Compatible" content="ie=edge,chrome=1"/>
<title>账户登陆</title>
<link rel="stylesheet" href="../css/login_mobile.css" media="screen and (max-width:768px)" />
<link rel="stylesheet" href="../css/login.css"/>
</head>
<body>
<?php
include("../conn/conn_mysql.php");
if($link){
echo '<h3>账户登录</h3>
<form method="post" action="checklogin.php" >
账户：<input id="account" name="account" type="text" style="width:150px;" /> </br>
密码：<input id="password" name="password" type="password" style="width:150px;"/> </br>
登陆权限：<input type="radio" name="rule" checked="checked" value="1"/>管理员 <input type="radio" name="rule" value="0"/>普通成员</br>
<input id="login" name="login" type="submit" value="登录"/>
<input id="reset" name="reset" type="reset" value="重置"/>
<a href="../register/region.php" target="_parent">没有账号，前往注册</a>
</form>';
echo "已成功连接到www.zhihua.com网络。";
}else{
echo '<h3>账户登录</h3>
<form method="post" action="#" >
账户：<input id="account" name="account" type="text" style="width:150px; background:#ccc;" value="限制输入" readonly/> </br>
密码：<input id="password" name="password" type="password" style="width:150px; background:#ccc;"value="000000" readonly/> </br>
<input id="login" name="login" type="submit" value="登录"/>
<input id="reset" name="reset" type="reset" value="重置"/>
<a href="../register/region.php" target="_parent">没有账号，前往注册</a>
</form>';
echo "与服务器连接中断，请检查网络连接。";
}
?>
<div id="cont">
</div>
</body>
</html>
这里对conn.php连接后台数据库做了一个判断，如果连接数据库成功，，则可以输入内容，否则显示另外一个不可输入的页面。
登录权限验证页面checklogin.php
<?php
session_start();
//header("Content-Type: text/html; charset=utf8");
if(!isset($_POST["login"])){
echo "<script>setTimeout(function(){window.location.href='login.php';},1000);</script>";
exit("非法操作！");
}
include("../conn/conn_mysql.php");
$account = trim($_POST["account"]);
$password = trim($_POST["password"]);
$rule = trim($_POST["rule"]);
if(!$account){
echo "账户未填写！";
echo "<script>setTimeout(function(){window.location.href='login.php';},1000);</script>";
}
if(!$password){
echo "密码未填写！";
echo "<script>setTimeout(function(){window.location.href='login.php';},1000);</script>";
}
//var_dump($account);
//var_dump($password);
/*
$link = mysqli_connect('localhost','root','Aa123123');
if(!$link){
echo "数据库连接失败！</br>";
}else{
echo "数据库连接成功";
}
mysqli_set_charset($link,'utf8');
mysqli_select_db($link,'news');
*/
$sql1 = "select * from user where account = '$account' and rule = '$rule'";
$res1 = mysqli_query($link,$sql1);
$result1 = mysqli_fetch_array($res1);
$asd1 = mysqli_num_rows($res1);
$sql = "select * from user where account = '$account' and password = '".md5(md5($password))."'";
$res = mysqli_query($link,$sql);
$result = mysqli_fetch_array($res);
$asd = mysqli_num_rows($res);
/*
var_dump($result);
echo "</br>";
echo "</br>";
var_dump($res);
echo "</br>";
echo "</br>";
var_dump($asd);
*/
if(!$asd1){
echo "账户不存在！";
echo "<script>setTimeout(function(){window.location.href='login.php';},1000);</script>";
}else if($asd1 && $asd){
$_SESSION["account"] = $account;
echo $result['rulename']."账户：".$result['account']."、登陆成功！正在为您跳转到账户首页.";
echo "<script>setTimeout(function(){window.location.href='login_info.php';},3000);</script>";
}else{
echo "密码错误！";
echo "<script>setTimeout(function(){window.location.href='login.php';},1000);</script>";
}
mysqli_close($link);
?>
登录成功后，对用户权限判断显示页面login_info.php
<!doctype html>
<html>
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1.0,user-scalable=false"/>
<meta http-equiv="X-UA-Compatible" content="ie=edge,chrome=1"/>
<title>账户主页</title>
<link rel="stylesheet" href="../css/login_info_mobile.css" media="screen and (max-width:768px)" />
<script src="../jquery/jquery-1.11.0.js" type="text/javascript"></script>
<script src="../js/showcity.js" type="text/javascript"></script>
<script>
function dislogin(){
var onck = confirm("注销账户?");
if(onck == true){
window.location.href="login_out.php";
}else{
window.location.href="#";
}
}
function changepwd(){
window.location.href="changepwd.php";
}
function changelogin(){
window.location.href="login_info.php";
}
function upload(){
window.location.href="upload.php";
}
</script>
</head>
<body>
<?php
session_start();
include_once("../conn/mysqli.php");
if(isset($_SESSION["account"]) && $_SESSION["account"]!=""){
$shacls = "select * from user where account = '".$_SESSION["account"]."'";
$shaclsrs = $mysqli->query($shacls);
$rs1 = mysqli_fetch_array($shaclsrs);
$showaccount = $rs1['account'];
$showname = $rs1['name'];
$showmesg = $rs1['mesg'];
$showtruename = $rs1['truename'];
$showsex = $rs1['sex'];
$showdate = $rs1['birthdar'];
$showphone = $rs1['phone'];
$showemail = $rs1['email'];
$showqq = $rs1['QQ'];
$showwechat = $rs1['wechat'];
//$showaddress = $rs1['address'];
$showprovince = $rs1['province'];
$showcountry = $rs1['country'];
$showcity = $rs1['city'];
$showditel = $rs1['ditel'];
$showrulename = $rs1['rulename'];
$showrule = $rs1['rule'];
switch($showrule){
case 0;
echo "<div id='showaccount1'><span> $showrulename 账户：$showaccount ，欢迎您！</span><input type='button' value='修改密码' onClick='changepwd();return false;' /></div>
<h4>个人信息表</h4>
<form method='post' action='updlogin_info.php' >
<div id='nickname1'>昵称：<input id='nickname' name='nickname' type='text' value='$showname' /></div>
<div id='mesg1'>个性签名：<textarea style='vertical-align:top;width:300px;height:100px;' id='mesg' name='mesg'>$showmesg</textarea></div>
<div id='truename1'>姓名：<input id='truename' name='truename' type='text' value=' $showtruename' /></div>
<div id='sex1'>性别：<select name='sex' id='sex'>
<option value='$showsex'>$showsex</option>
<option value='保密'>保密</option>
<option value='男'>男</option>
<option value='女'>女</option>
</select></div>
<div id='birthday1'>生日：<input type='date' id='birthday' name='birthday' value='$showdate'/></div>
<div id='phone1'>手机：<input id='phone' name='phone' type='text' value='$showphone' /></div>
<div id='email1'>E-Mail：<input id='email' name='email' type='text' value='$showemail'/></div>
<div id='qq1'>QQ：<input id='qq' name='qq' type='text' value='$showqq'/></div>
<div id='wechat1'>微信：<input id='wechat' name='wechat' type='text' value='$showwechat'/></div>
<sapn id='showcity'>收货地址：</span>
<select id='provinces' name='provinces'><option value=''>$showprovince</option></select>
<select id='citys' name='citys'><option value=''>$showcountry</option></select>
<select id='countys' name='countys'><option value=''>$showcity</option></select>
<div id='ditel1'>街道/小区：<input id='ditel' name='ditel' type='text' value='$showditel' /></div>
<div id='tools'><input id='btnchg' name='btnchg' type='submit' value='修改信息' />
<input type='button' value='刷新信息' οnclick='changelogin();return false;'/>
<input type='button' value='注销' οnclick='dislogin();return false;'/></div>
</form>";
break;
case 1;
echo "<div id='showaccount1'><span> $showrulename 账户：$showaccount ，欢迎您！</span><input type='button' value='修改密码' onClick='changepwd();return false;' /></div>
<h4>个人信息表</h4>
<form method='post' action='updlogin_info.php' >
<div id='nickname1'>昵称：<input id='nickname' name='nickname' type='text' value='$showname' /></div>
<div id='mesg1'>个性签名：<textarea style='vertical-align:top;width:300px;height:100px;' id='mesg' name='mesg'>$showmesg</textarea></div>
<div id='truename1'>姓名：<input id='truename' name='truename' type='text' value=' $showtruename' /></div>
<div id='sex1'>性别：<select name='sex' id='sex'>
<option value='$showsex'>$showsex</option>
<option value='保密'>保密</option>
<option value='男'>男</option>
<option value='女'>女</option>
</select></div>
<div id='birthday1'>生日：<input type='date' id='birthday' name='birthday' value='$showdate'/></div>
<div id='phone1'>手机：<input id='phone' name='phone' type='text' value='$showphone' /></div>
<div id='email1'>E-Mail：<input id='email' name='email' type='text' value='$showemail'/></div>
<div id='qq1'>QQ：<input id='qq' name='qq' type='text' value='$showqq'/></div>
<div id='wechat1'>微信：<input id='wechat' name='wechat' type='text' value='$showwechat'/></div>
<sapn id='showcity'>收货地址：</span>
<select id='provinces' name='provinces'><option value=''>$showprovince</option></select>
<select id='citys' name='citys'><option value=''>$showcountry</option></select>
<select id='countys' name='countys'><option value=''>$showcity</option></select>
<div id='ditel1'>街道/小区：<input id='ditel' name='ditel' type='text' value='$showditel' /></div>
<div id='tools'><input id='btnchg' name='btnchg' type='submit' value='修改信息' />
<input type='button' value='刷新信息' οnclick='changelogin();return false;'/>
<input type='button' value='上传文件' οnclick='upload();return false;'/>
<input type='button' value='注销' οnclick='dislogin();return false;'/></div>
</form>";
break;
default;
echo "账户未激活！3秒后跳转到登录首页。";
echo "<script>setTimeout(function(){window.location.href='login.php';},3000);</script>";
break;
}
}else{
echo "<script>setTimeout(function(){window.location.href='login.php';},3000);</script>";
exit("无法读取数据，请前往登录！");
}
?>
</body>
</html>
代码和数据库设计已经完成，请往下看验证效果。
首先什么也不输入，直接点击登录，结果检测到账户未填写，密码未填写，账户不存在。
仅输入账户，直接登录，检测提示密码未填写，密码错误。
仅输入密码，直接登录，检测提示账户未填写，账户不存在。
这时，账户和密码都能准确检测出异常。
再回到user数据表，看到账户为220022的rule值为1，身份是管理员，账户为110011的rule值为0，身份是普通成员。
接下来验证他们的身份吧！
当账户220022选择普通成员登录时，检测提示账户不存在。
而当改为管理员登录时，检测提示成功登录，并跳转到管理员板块。
到验证账户110011
当账户110011选择管理员登录，检测提示账户不存在。
当改为普通成员登录时，检测提示成功登录，跳转到普通成员板块。
可以看出管理员和普通成员均能正确检测，且正确跳转到不同的权限管理页面。
演示完毕，谢谢观看！
扫一扫
902
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
