使用Cookie和Salted Hashes的PHP登录系统

<?php
session_start();

// 连接数据库
$conn = new mysqli('localhost', 'username', 'password', 'database');

// 检查连接是否成功
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// 当用户提交登录表单时
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $username = $_POST["username"];
    $password = $_POST["password"];

    // 从数据库中获取用户信息
    $sql = "SELECT id, username, password_hash FROM users WHERE username = ?";
    if ($stmt = $conn->prepare($sql)) {
        $stmt->bind_param("s", $username);
        $stmt->execute();
        $stmt->store_result();

        // 验证用户名和密码
        if ($stmt->num_rows == 1) {
            $stmt->bind_result($id, $username, $password_hash);
            $stmt->fetch();

            if (password_verify($password, $password_hash)) {
                // 密码验证成功，设置Session
                session_regenerate_id();
                $_SESSION["loggedin"] = true;
                $_SESSION["id"] = $id;
                $_SESSION["username"] = $username;

                // 设置Cookie
                setcookie("username", $username, time() + (86400 * 30), "/"); // 86400 = 1 day

                header("location: welcome.php");
            } else {
                echo "密码错误";
            }
        } else {
            echo "用户名不存在";
        }

        $stmt->close();
    }
}

$conn->close();
?>