php 网站进入后台

// 示例代码：检查用户名和密码
$username = $_POST['username'];
$password = $_POST['password'];

// 假设数据库连接信息
$host = 'localhost';
$dbname = 'mydb';
$user = 'dbuser';
$pass = 'dbpass';

try {
    $pdo = new PDO("mysql:host=$host;dbname=$dbname", $user, $pass);
    $stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");
    $stmt->bindParam(':username', $username);
    $stmt->execute();
    $user = $stmt->fetch();

    if ($user && password_verify($password, $user['password'])) {
        // 登录成功
        session_start();
        $_SESSION['user_id'] = $user['id'];
        header('Location: admin.php');
        exit();
    } else {
        echo "用户名或密码错误";
    }
} catch (PDOException $e) {
    echo "数据库连接失败: " . $e->getMessage();
}

// 示例代码：权限检查
session_start();
$user_id = $_SESSION['user_id'];

// 假设权限表结构
// users: id, username, password
// roles: id, name
// permissions: id, name
// role_permissions: role_id, permission_id
// user_roles: user_id, role_id

try {
    $pdo = new PDO("mysql:host=$host;dbname=$dbname", $user, $pass);
    $stmt = $pdo->prepare("SELECT p.name FROM permissions p JOIN role_permissions rp ON p.id = rp.permission_id JOIN user_roles ur ON rp.role_id = ur.role_id WHERE ur.user_id = :user_id");
    $stmt->bindParam(':user_id', $user_id);
    $stmt->execute();
    $permissions = $stmt->fetchAll(PDO::FETCH_COLUMN);

    if (in_array('admin', $permissions)) {
        // 有管理员权限
    } else {
        echo "无权限访问";
    }
} catch (PDOException $e) {
    echo "数据库连接失败: " . $e->getMessage();
}