我正在开发我的第一个基于 PHP 的网站，我想知道用户名/密码系统有哪些解决方案？我曾尝试使用 .htaccess 文件来实现基本安全，虽然它有效，但我希望外行人可以更轻松地管理一些东西。还有其他我可以尝试的解决方案吗？我没有可用的数据库服务器，所以它必须支持平面文件数据库...谢谢!

编辑 我确定我确实有 SQLite 支持，所以我有一个可用的数据库选项。另外，我觉得我应该进一步提一下我的一些要求。我最初希望使用 .htaccess 来保护我的网站，因为我需要整个目录的安全性。我试图保护的大多数文件都是 .pdf 和 .doc...任何解决方案都必须允许我保护这些文件以及目录中的任何网页。

如果我能找到一个好的解决方案来或多或少地“蒙皮”锁定目录的 .htaccess 方法，这样我就可以做一些事情，比如拥有一个实际的登录/注册页面等，那么我会坚持使用.htaccess 方法。但是，我想要更易于管理的东西，我只需要目录安全性。

最佳答案

这段代码我很快就写好了，它在语法上是正确的，但我还没有测试过。
这里有两件事我没有做，第一，我没有提供删除用户的功能，第二，我没有提供更改用户密码的功能，这些你必须自己写。
然而，这应该是一个很好的起点。

这些函数会将您的用户名/密码存储在一个名为 passwords 的文件中，格式如下

username0:password0
username1:password1
username2:password2
...

.

function authenticate($username, $password)
{

    //ALWAYS use a salt to secure the encryption of your passwords, this can be any value of any
    //length, the longer and the more characters the better
    //I like to use a "perfect password" from Steve Gibbson's https://www.grc.com/passwords.htm
    //This must the exactly the same as the salt in theaddUser() function
    $salt = 'voDeaFWckErOPPGwiapYBwEoc4O2d1M60m2QsYc7A15PUshrLamoVioG1wUmEgF';

    //First we need to get the contents of the file that has the usernames/passwords in it.
    //we don't want to use fopen() or we may end up with a locked file error if another access is 
    //attempted before we've closed it.

    //this line will get the contents of the file named passwords and store it in the $fh variable
    $fh = file_get_contents('passwords');

    //Now lets take the file and split it into an array where each line is a new element in the array.
    $fh = split("\n", $fh);

    //Now lets loop over the entire array spliting each row into it's username/password pair
    foreach($fh as $r)
    {
        //Every time this loop runs $r will be populated with a new row

        //Lets split the line into it's username/password pairs.
        $p = split(':', $p);

        //Since we don't need all the usernames/password to be in memory lets stop when we find the one we need
        if($p[0] == $username && $p[1] == sha1($salt . $password))
        {
            //We've found the correct use so lets stop looping and return true
            return true;
        }
    }
    //If we've reached this point in the code then we did not find the user with the correct password in the 'database'
    //so we'll just return false
    return false;
}
function addUser($username, $password)
{
    //ALWAYS use a salt to secure the encryption of your passwords, this can be any value of any
    //length, the longer and the more characters the better
    //I like to use a "perfect password" from Steve Gibbson's https://www.grc.com/passwords.htm
    //This must the exactly the same as the salt in the authenticate() function
    $salt = 'voDeaFWckErOPPGwiapYBwEoc4O2d1M60m2QsYc7A15PUshrLamoVioG1wUmEgF';

    //We need to parse out some preticularly bad characters from the user name such as : which is used to seperate the username and password
    //and \r and \n which is the new line character which seperates our lines
    $username = preg_replace('/\r|\n|\:/', '', $username);

    //Now lets encrypt our password with the salt added
    $password = sha1($salt . $password);

    //Lets build the new line that is going to be added
    $line = $username . ':' . $password . "\n";

    //Lets open the file in append mode so that the pointer will be placed at the end of the file
    $fh = fopen('passwords', 'a');

    //Write the new entry to the file
    fwrite($fh, $line);

    //Close the file
    fclose($fh);

    //Typicaly one would write a bunch of error handling code on the above statments and if something
    //goes wrong then return false but if you make it this far in the code then return true
    return true;
}

关于PHP用户名密码解决方案，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/1084814/