// 登录成功后 if ($user && password_verify($password, $user['password'])) { // 重新生成session ID防止固定攻击 session_regenerate_id(true); // 清除旧session $_SESSION = array(); // 设置session变量 $_SESSION['user_id'] = (int)$user['id']; $_SESSION['username'] = $user['username']; $_SESSION['is_admin'] = (int)($user['is_admin'] ?? 0); $_SESSION['login_time'] = time(); // 缓存用户数据 $_SESSION['user_data'] = $user; // 记住我功能 if ($remember) { $token = bin2hex(random_bytes(32)); setcookie('remember_token', $token, time() + 7 * 24 * 3600, '/'); $db->prepare("UPDATE users SET remember_token = ? WHERE id = ?")->execute([$token, $user['id']]); } // 跳转首页 redirect(getSiteUrl() . '/'); exit; }