0,'time'=>time()];
$loginErr = $_SESSION[$lockKey];
// 修复BUG：超过5分钟重置
if (time() - $loginErr['time'] > 300) {
$_SESSION[$lockKey] = ['num'=>0,'time'=>time()];
$loginErr = $_SESSION[$lockKey];
}
if ($_POST) {
$username = trim($_POST['username'] ?? '');
$pwd = trim($_POST['pwd'] ?? '');
// ===================== 调试输出（帮你定位问题） =====================
echo "";
echo "你输入的账号：" . $username . "
";
echo "你输入的密码：" . $pwd . "
";
$conn = mysqli_connect($dbHost, $dbUser, $dbPass, $dbName);
if (!$conn) {
die("数据库连接失败：" . mysqli_connect_error());
}
$u = mysqli_real_escape_string($conn, $username);
$sql = "SELECT id,username,password,role FROM sys_user WHERE username='$u' LIMIT 1";
$res = mysqli_query($conn, $sql);
$user = mysqli_fetch_assoc($res);
echo "数据库查到的用户：" . ($user ? $user['username'] : "无此用户") . "
";
echo "数据库密码哈希：" . ($user ? $user['password'] : "无") . "
";
$checkResult = $user ? password_verify($pwd, $user['password']) : false;
echo "密码校验结果：" . var_export($checkResult, true) . "
";
echo "
";
exit;
// ===================== 调试结束 =====================
if ($loginErr['num'] >= 5) {
$errMsg = "密码错误次数过多，请5分钟后重试";
} elseif (!$username || !$pwd) {
$errMsg = "账号密码不能为空";
} else {
$conn = mysqli_connect($dbHost, $dbUser, $dbPass, $dbName);
$u = mysqli_real_escape_string($conn, $username);
$sql = "SELECT id,username,password,role FROM sys_user WHERE username='$u' LIMIT 1";
$res = mysqli_query($conn, $sql);
$user = mysqli_fetch_assoc($res);
if ($user && password_verify($pwd, $user['password'])) {
$_SESSION[$lockKey] = ['num'=>0,'time'=>time()];
$_SESSION['user_id'] = $user['id'];
$_SESSION['username'] = $user['username'];
$_SESSION['role'] = $user['role'];
$_SESSION['login_time'] = time();
mysqli_query($conn, "UPDATE sys_user SET last_login=NOW() WHERE id=".$user['id']);
header("Location: dashboard.php");
exit;
} else {
$_SESSION[$lockKey]['num']++;
$errMsg = "账号或密码错误";
}
mysqli_close($conn);
}
}
?>
登录 - 企业运维告警监控平台