安全登录：使用PDO预处理语句和密码哈希

<?php
    require "../private/php/autoload.php";
    $error = "";

    if($_SERVER['REQUEST_METHOD'] == "POST" && isset($_SESSION['token']) && isset($_POST['token']) && $_SESSION['token'] == $_POST['token']){
        $email = $_POST['email'];
        if(!preg_match("/^[\w\-]+@[\w\-]+.[\w\-]+$/", $email)){
            $error = "Please enter a valid email.";
        }

        $password = $_POST['password'];

        if ($error == ""){
            // 只根据邮箱查询，不要在SQL查询中传递未哈希的密码
            $arr['email'] = $email;

            $query = "SELECT * FROM users WHERE email = :email LIMIT 1";
            $stm = $conn->prepare($query);
            $check = $stm->execute($arr);

            if($check){
                $data = $stm->fetchAll(PDO::FETCH_OBJ);
                if(is_array($data) && count($data) > 0){
                    $data = $data[0];
                    // 使用 password_verify 验证密码
                    if (password_verify($_POST['password'], $data->password)){
                        $_SESSION['username'] = $data->username;
                        $_SESSION['user_id'] = $data->user_id;
                        header("Location: index.php");
                        die;
                    }
                }
            }
        }
        $error = "Wrong email or password!";
    }
    $_SESSION['token'] = get_random_string(30);
?>

<?php
$password = 'testtest';
$hashed_password = password_hash($password, PASSWORD_DEFAULT);

echo $hashed_password;
?>