PHP代码重构和修复常见安全漏洞

$name = htmlspecialchars($_POST['name'], ENT_QUOTES, 'UTF-8');
echo "欢迎你，".$name;

$pdo = new PDO('mysql:host=localhost;dbname=mydb;charset=utf8', 'username', 'password');
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username AND password = :password");
$stmt->bindParam(':username', $_POST['username']);
$stmt->bindParam(':password', $_POST['password']);
$stmt->execute();

$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["file"]["name"]);
$uploadOk = 1;
$imageFileType = strtolower(pathinfo($target_file,PATHINFO_EXTENSION));

// 检查文件类型
if($imageFileType != "jpg" && $imageFileType != "png" && $imageFileType != "jpeg"
&& $imageFileType != "gif" ) {
    $uploadOk = 0;
}

// 检查文件大小
if ($_FILES["file"]["size"] > 500000) {
    $uploadOk = 0;
}

// 检查文件名
if (file_exists($target_file)) {
    $uploadOk = 0;
}

if ($uploadOk == 0) {
    echo "文件上传失败。";
} else {
    if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
        echo "文件已成功上传。";
    } else {
        echo "文件上传失败。";
    }
}

session_start();
if (!isset($_SESSION['user_id'])) {
    header("Location: login.php");
    exit;
}
session_regenerate_id();