웹사이트 보안 및 보호를 위해 PHP를 사용하는 방법

$username = $_POST['username'];
$password = $_POST['password'];

$stmt = $pdo->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
$stmt->execute([$username, $password]);
$user = $stmt->fetch();

$name = $_POST['name'];
$message = $_POST['message'];

$name = htmlspecialchars($name, ENT_QUOTES, 'UTF-8');
$message = htmlspecialchars($message, ENT_QUOTES, 'UTF-8');

echo "姓名：".$name."<br>";
echo "留言：".$message."<br>";

session_start();

if (isset($_POST['username']) && isset($_POST['password'])) {
    // 验证用户登录
    // ...

    session_regenerate_id(true); // 重新生成会话 ID
    $_SESSION['user'] = $user;
}

$allowedTypes = ['jpg', 'jpeg', 'png'];
$maxSize = 1024 * 1024; // 1MB
$uploadDir = 'uploads/';

if (isset($_FILES['file'])) {
    $file = $_FILES['file'];

    if ($file['error'] === UPLOAD_ERR_OK) {
        $fileExt = pathinfo($file['name'], PATHINFO_EXTENSION);

        if (in_array($fileExt, $allowedTypes) && $file['size'] <= $maxSize) {
            $fileName = uniqid().'.'.$fileExt;
            $destination = $uploadDir.$fileName;
            move_uploaded_file($file['tmp_name'], $destination);
            echo "文件上传成功！";
        } else {
            echo "文件类型或大小不符合要求！";
        }
    } else {
        echo "文件上传失败！";
    }
}

function logActivity($message) {
    $logFile = 'log.txt';
    $logMessage = "[".date('Y-m-d H:i:s')."] ".$message."
";
    file_put_contents($logFile, $logMessage, FILE_APPEND);
}

// 登录成功后记录日志
logActivity("用户登录成功：".$_SESSION['user']['username']);

// 进行敏感操作后记录日志
logActivity("用户进行操作：修改个人信息");