How to prevent non-logged-in users from directly jumping to the backend in PHP

When using PHP to develop a website, ensuring the security of user information is a very important task. One of them is to prohibit non-logged-in users from directly jumping to the backend to prevent illegal operations, information leakage and other issues. This article will introduce how to use PHP coding to prevent non-logged-in users from directly accessing the backend.

1. Session realizes login

In order to ensure the security of user information, session is often used in website development to store the user's basic information, including user ID, user name, and password. Wait, using session login can also effectively prevent some website security issues and make the website run more stable and secure.

session is a technology for storing and accessing information on the server side. Its advantage is that it can be stored and used very flexibly. In PHP, to use session, you need to turn on the session switch and set session save_path. After logging in, use the session_register() function to store user information in the session. The code is implemented as follows:

<?php session_start();
$username="admin";//定义用户名
$password="123456";//定义密码
if($_POST[&#39;username&#39;]==$username && $_POST[&#39;password&#39;]==$password)
{
  $_SESSION[&#39;username&#39;]=$username;//将用户名存入内存中
  $_SESSION[&#39;password&#39;]=$password;//将密码存入内存中
  header("Location: admin.php");//跳转到后台页面
  exit();
}
?>

2. Implement prohibition of unauthorized access The function for logged-in users to directly access the backend

To implement the function of prohibiting non-logged-in users from directly accessing the backend, it is necessary to determine whether they have logged in on the backend page. You can add the following code to the header of the background page:

<?php session_start();
if(!isset($_SESSION[&#39;username&#39;])||!isset($_SESSION[&#39;password&#39;]))
{
    header("Location: index.php");//跳转到登陆页面（也可自定义其他跳转页面）
    exit();
}
?>

Code explanation: First enable the session, and then determine whether a user has logged in. If not, jump directly back to the login page and exit PHP.

For better information security, it is recommended to set the session_regenerate_id() function after session_start() to update the session_id to enhance the security of the website.

3. Complete sample code

The following is a complete sample code that prohibits non-logged-in users from directly accessing the backend, for reference:

<?php //login.php 登陆页面
session_start();
$username="admin";//定义用户名
$password="123456";//定义密码
if($_POST[&#39;username&#39;]==$username && $_POST[&#39;password&#39;]==$password)
{
  $_SESSION[&#39;username&#39;]=$username;
  $_SESSION[&#39;password&#39;]=$password;
  header("Location: admin.php");//跳转到后台页面
  exit();
}
?>

<?php //admin.php 后台页面
session_start();
if(!isset($_SESSION[&#39;username&#39;])||!isset($_SESSION[&#39;password&#39;]))
{
    header("Location: login.php");//跳转到登陆页面（也可自定义其他跳转页面）
    exit();
}

session_regenerate_id(true);// 更新 session_id
?>

In short , the above methods are all effective ways to protect website information security, but there are also some risks. Especially when using sessions, you need to be extra careful to avoid user information leakage and other issues.

The above is the detailed content of How to prevent non-logged-in users from directly jumping to the backend in PHP. For more information, please follow other related articles on the PHP Chinese website!