PHP 表单提交与安全注册

<?php
session_set_cookie_params([
    'path' => '/',
    'secure' => true,
    'httponly' => true,
    'samesite' => 'Lax',
]);

session_start();
$_SESSION['csrf_token'] ??= bin2hex(random_bytes(32));

function escapeHtml(string $value): string
{
    return htmlspecialchars($value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
}
?>

<form method="post" action="" autocomplete="on">
  <input
    type="hidden"
    name="csrf_token"
    value="<?= escapeHtml($_SESSION['csrf_token']) ?>"
  >

  <label for="username">用户名</label>
  <input
    id="username"
    name="username"
    type="text"
    autocomplete="username"
    maxlength="32"
    required
  >

  <label for="password">密码</label>
  <input
    id="password"
    name="password"
    type="password"
    autocomplete="new-password"
    required
  >

  <label for="confirm_password">确认密码</label>
  <input
    id="confirm_password"
    name="confirm_password"
    type="password"
    autocomplete="new-password"
    required
  >

  <label>
    <input type="checkbox" name="agree" value="yes" required>
    我已阅读并同意服务条款
  </label>

  <button type="submit" name="action" value="register">注册</button>
</form>

<?php
$message = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $action = $_POST['action'] ?? null;
    $csrfToken = $_POST['csrf_token'] ?? null;

    if (
        !is_string($csrfToken)
        || !hash_equals($_SESSION['csrf_token'], $csrfToken)
    ) {
        $message = '表单已过期，请刷新后重试。';
    } elseif ($action === 'register') {
        $username = $_POST['username'] ?? null;
        $password = $_POST['password'] ?? null;
        $confirmation = $_POST['confirm_password'] ?? null;
        $agreed = $_POST['agree'] ?? null;

        if (
            !is_string($username)
            || !is_string($password)
            || !is_string($confirmation)
        ) {
            $message = '请检查表单内容。';
        } else {
            $username = trim($username);

            if (!preg_match('/\A[A-Za-z0-9_.-]{3,32}\z/', $username)) {
                $message = '用户名格式不符合要求。';
            } elseif ($password !== $confirmation) {
                $message = '两次输入的密码不一致。';
            } elseif (
                !mb_check_encoding($password, 'UTF-8')
                || mb_strlen($password, 'UTF-8') < 12
                || strlen($password) > 72
            ) {
                $message = '密码长度不符合要求。';
            } elseif ($agreed !== 'yes') {
                $message = '请先同意服务条款。';
            } else {
                // 校验通过后，执行下方的数据库写入。
            }
        }
    }
}
?>

<?php
$dsn = getenv('APP_DSN');
$dbUser = getenv('APP_DB_USER');
$dbPassword = getenv('APP_DB_PASSWORD');

if (!is_string($dsn) || $dsn === '') {
    throw new RuntimeException('Database configuration is missing.');
}

$pdo = new PDO(
    $dsn,
    is_string($dbUser) ? $dbUser : null,
    is_string($dbPassword) ? $dbPassword : null,
    [
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
    ],
);
?>

<?php
$passwordHash = password_hash($password, PASSWORD_DEFAULT);

$statement = $pdo->prepare(
    'INSERT INTO users (username, password_hash) VALUES (:username, :password_hash)'
);
$statement->execute([
    'username' => $username,
    'password_hash' => $passwordHash,
]);

// 仅在 INSERT 成功后更新 token 并显示成功。
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
$message = '注册成功。';
?>

<?php
$username = $_POST['username'] ?? null;
$password = $_POST['password'] ?? null;

if (
    !is_string($username)
    || !is_string($password)
    || strlen($username) > 32
    || strlen($password) > 72
) {
    $message = '用户名或密码错误。';
} else {
    $statement = $pdo->prepare(
    'SELECT id, password_hash FROM users WHERE username = :username'
    );
    $statement->execute(['username' => $username]);
    $user = $statement->fetch();

    if (
        !is_array($user)
        || !is_string($user['password_hash'] ?? null)
        || !password_verify($password, $user['password_hash'])
    ) {
        $message = '用户名或密码错误。';
    } else {
        if (!session_regenerate_id()) {
            throw new RuntimeException('Unable to rotate session ID.');
        }

        $_SESSION['user_id'] = (int) $user['id'];
        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
    }
}
?>

<?php if ($message !== ''): ?>
  <p role="status"><?= escapeHtml($message) ?></p>
<?php endif; ?>

<label for="username">用户名</label>
<input
  id="username"
  name="username"
  value="<?= escapeHtml($username ?? '') ?>"
  autocomplete="username"
>

<form method="post" enctype="multipart/form-data">
  <input
    type="hidden"
    name="csrf_token"
    value="<?= escapeHtml($_SESSION['csrf_token']) ?>"
  >
  <label for="avatar">头像</label>
  <input
    id="avatar"
    type="file"
    name="avatar"
    accept="image/png,image/jpeg"
    required
  >
  <button type="submit" name="action" value="upload">上传</button>
</form>

<?php
$file = $_FILES['avatar'] ?? null;

if (!is_array($file) || ($file['error'] ?? UPLOAD_ERR_NO_FILE) !== UPLOAD_ERR_OK) {
    throw new RuntimeException('Upload failed.');
}

$size = $file['size'] ?? null;
$tempPath = $file['tmp_name'] ?? null;

if (!is_int($size) || $size > 5 * 1024 * 1024) {
    throw new RuntimeException('File is too large.');
}

if (!is_string($tempPath) || !is_uploaded_file($tempPath)) {
    throw new RuntimeException('Invalid upload.');
}

$mimeType = (new finfo(FILEINFO_MIME_TYPE))->file($tempPath);
$extensions = [
    'image/jpeg' => 'jpg',
    'image/png' => 'png',
];

if (!is_string($mimeType) || !isset($extensions[$mimeType])) {
    throw new RuntimeException('Unsupported file type.');
}

$destination = $privateUploadDirectory
    . DIRECTORY_SEPARATOR
    . bin2hex(random_bytes(16))
    . '.'
    . $extensions[$mimeType];

if (!move_uploaded_file($tempPath, $destination)) {
    throw new RuntimeException('Unable to store uploaded file.');
}
?>