// 登录成功后
if ($user && password_verify($password, $user['password'])) {
// 重新生成session ID防止固定攻击
session_regenerate_id(true);
// 清除旧session
$_SESSION = array();
// 设置session变量
$_SESSION['user_id'] = (int)$user['id'];
$_SESSION['username'] = $user['username'];
$_SESSION['is_admin'] = (int)($user['is_admin'] ?? 0);
$_SESSION['login_time'] = time();
// 缓存用户数据
$_SESSION['user_data'] = $user;
// 记住我功能
if ($remember) {
$token = bin2hex(random_bytes(32));
setcookie('remember_token', $token, time() + 7 * 24 * 3600, '/');
$db->prepare("UPDATE users SET remember_token = ? WHERE id = ?")->execute([$token, $user['id']]);
}
// 跳转首页
redirect(getSiteUrl() . '/');
exit;
}
↑