好的，所以在我的主要登录 php 页面上我有这个:

<?php
session_start();
require 'connect.php';

if(mysqli_connect_errno()) {
    echo 'Failed to Connect to MySQL' . mysqli_connect_errno();
}

if(isset($_POST['submit'])) {
    //Variables
    $user = $_POST['username'];
    $pass =  md5 ($_POST['password']);

    //prevent MySQL Inject
    $user = stripslashes($user);
    $pass = stripslashes($pass);

    $query = mysqli_query($con, "SELECT * FROM tech WHERE username = '$user' and password = '$pass'") or die("Can not query the DB");
    $count = mysqli_num_rows($query);

    if($count == 1) {
        $_SESSION['username'] = $user;
        $url = 'home.php';
        echo '<META HTTP-EQUIV=Refresh CONTENT="0; URL='.$url.'">';
    } else {
        echo 'Username and Password do not match! Try Again';
        $url = 'carelogin.php';
        echo '<META HTTP-EQUIV=Refresh CONTENT="2; URL='.$url.'">';
        session_destroy();
    }
}
?>

然后，在最顶部的每个页面上我都有这个。

<?php
session_start();
require_once 'connect.php';

if(!isset($_SESSION['username'])) {
    echo "<h1>You are not an authorised user</h1>";
    $url = 'carelogin.php';
    echo '<META HTTP-EQUIV=Refresh CONTENT="1; URL='.$url.'">';
} else {
}
?>

大约 30 秒后，如果我单击“刷新”或者如果我前进或后退，我不会在任何这些页面上触摸我的鼠标，它会一直注销我。我不明白。我设置了所有 session ，但在短短 30 秒内我就注销了。

有人请修改我的代码以允许我保持登录状态，直到我单击注销谢谢你们!

最佳答案

我想你会发现人们会为这类事情建议一个框架，但是，如果你要尝试登录，你可能希望更彻底地拆分脚本以容纳更清晰和更可扩展的代码.另外，确保使用 ini_set("display_errors",1); error_reporting(E_ALL); 在 session_start() 之上，在测试网站时收到页面上发生的任何错误/警告的警报(在实时环境中关闭错误报告)。

这里的代码比您拥有的要复杂一些，但它应该可以保护您免受注入(inject)。请注意，每个文件的所有文件夹都应与域根 相关。另请注意，您需要使用 password_hash() 函数将所有密码存储在数据库中。您可以使用其中的一些，所有这些，或者全部都不使用，但是如果您确实使用了它，请务必阅读 PHP 手册以了解所有这些在做什么:

/core.processor/classes/class.DatabaseConfig.php

// This is your database. Fill out the credentials in the connect() method
// I use PDO because I think personally it's easier to use
class   DatabaseConfig
    {
        private static  $singleton;

        public  function __construct()
            {
                if(empty(self::$singleton))
                    self::$singleton    =   $this->connect();

                return self::$singleton;
            }
        // This is the method that creates the database connection
        public  function connect($host = "localhost", $username = "username", $password = "password", $database = "database")
            {
                // Create connection options
                // 1) Make PDO Exception errors, 2) Do real binding 3) By default prefer fetching associative arrays
                $opts   =   array(  PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
                                    PDO::ATTR_EMULATE_PREPARES => false,
                                    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC);
                $conn   =   new PDO('mysql:host='.$host.';dbname='.$database, $username, $password,$opts);
                // Send back the database connection. You can use a "utf-8" character setting here as well...
                return $conn;
            }
    }

/core.processor/classes/class.QueryEngine.php

// This is a simple query engine. It allows for binding (or not binding)
class   QueryEngine
    {
        private $results;

        private static  $singleton;

        public  function __construct()
            {
                if(empty(self::$singleton))
                    self::$singleton    =   $this;

                return self::$singleton;
            }
        // This method sends queries to your database
        public  function query($sql = false,$bind = false)
            {
                $this->results  =   0;
                // Create database connection
                $db     =   new DatabaseConfig();
                // Attempt to connect and fetch data
                try {
                        // Bind or not bind, provided there is a bind array
                        // This is important to look up!
                        if(!empty($bind)) {
                                $query  =   $db ->connect()
                                                ->prepare($sql);
                                $query->execute($bind);
                            }
                        else {
                                $query  =   $db ->connect()
                                                ->query($sql);
                            }

                        $this->results  =   $query;
                    }
                catch (PDOException $e)
                    {
                        die($e->getMessage());
                    }

                return $this;
            }
        // This method will fetch an the associative array if used with select statement
        public  function fetch()
            {
                while($row = $this->results->fetch())
                    $result[]   =   $row;

                return (!empty($result))? $result : 0;
            }
    }

/core.processor/classes/class.HeaderProcessor.php

// This class deals with functions that should happen before the page outputs to the browswer
class   HeaderProcessor
    {
        private static  $userData;

        // This method just sits and waits for actions to happen
        // This method should expand with whatever you plan to do in the future
        public  static  function eventListener($array = array())
            {       
                if(isset($array['action'])) {
                        if($array['action'] == 'login') {
                                if(self::getLogin($array['username'],$array['password'])) {
                                        if(self::setSession(self::$userData)) {
                                                $_SESSION['password']   =   NULL;
                                            }
                                        header("Location: home.php");
                                        exit;
                                    }
                            }
                        elseif($array['action'] == 'logout') {
                                session_destroy();
                                header("Location: loggedout.php");
                                exit;
                            }
                    }
            }
        // Process login
        private static  function getLogin($user,$pass)
            {
                $query      =   new QueryEngine();
                $getUser    =   $query  ->query("SELECT * FROM `users` WHERE `username` = :0",array($user))
                                        ->fetch();

                if($getUser == 0)
                    return false;

                self::$userData =   $getUser[0];
                // Verify the password hash (this is why you need to store your passwords differently in your db
                return password_verify($pass,$getUser[0]['password']);
            }
        // Assign session variables
        private static  function setSession($userData)
            {
                $_SESSION   =   array_filter(array_merge($userData,$_SESSION));

                return true;    
            }
        // This can set options for your site, I just threw in timezone
        // as well as the class autoloader
        public  static  function initApp($settings = false)
            {
                $timezone   =   (!empty($settings['timezone']))? $settings['timezone'] : 'America/Los_Angeles';
                include_once(FUNCTIONS_DIR."/function.autoLoader.php");

                date_default_timezone_set($timezone);
            }
    }

/core.processor/functions/function.autoLoader.php

// This function will auto load your classes so you don't have to always
// include files. You could make a similar function to autoload functions
function autoLoader($class)
    {
        if(class_exists($class))
            return true;

        if(is_file($include = CLASS_DIR.'/class.'.$class.'.php'))
            include_once($include);
    }

/config.php

/*** This config is located in the root folder and goes on every page ***/

// Start session
session_start();
// Define common places
define("ROOT_DIR",__DIR__);
define("CLASS_DIR",ROOT_DIR.'/core.processor/classes');
define("FUNCTIONS_DIR",ROOT_DIR.'/core.processor/functions');
// Require the page initializer class
require_once(CLASS_DIR."/class.HeaderProcessor.php");
// Initialize the autoloader for classes
// Load timezone
// You can put any other preset in this method
HeaderProcessor::initApp();
// Here is where you put in events like login, logout, etc...
HeaderProcessor::eventListener($_POST);
// Use this function to help load up classes
spl_autoload_register('autoLoader');

/login.php

<?php
// add in the config file
require(__DIR__."/config.php");
?><!DOCTYPE html>
<html>
<meta charset="UTF-8">
<title>My Login</title>
<head>
</head>
<body>
    <form id="loginForm" method="post" action="">
        <input name="username" type="text" />
        <input name="password" type="password" />
        <input name="action" type="hidden" value="login" />
        <input type="submit" value="LOGIN" />
    </form>
</body>
</html>

关于php - session 一直让我注销，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/33819716/