Skip to content

Commit

Permalink
初始化
Browse files Browse the repository at this point in the history
  • Loading branch information
@srauni
srauni committed Jul 18, 2020
0 parents commit 68a6fb8
Show file tree
Hide file tree
Showing 12 changed files with 1,024 additions and 0 deletions.
204 changes: 204 additions & 0 deletions admin.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,204 @@
<title>宾馆管理系统后台</title>
<p>欢迎登录宾馆管理系统后台</p>
<?php
// 连接数据库
$link = mysqli_connect('localhost:3308', 'root', '');
if (!$link) {
echo '数据库连接失败<br>';
exit();
}

// 如果大作业数据库没有则创建
$sql = 'create database if not exists bigwork';
$result = mysqli_query($link, $sql);
if (!$result) {
echo '执行失败'.mysqli_error($link);
}

// 选择大作业数据库
$sql = 'use bigwork';
$result = mysqli_query($link, $sql);
if (!$result) {
echo '执行失败'.mysqli_error($link);
}

// 创建用户的数据表 用户名 密码
$sql = <<<xxx
create table if not exists userinfo(
user varchar(20) not null primary key,
pwdhash varchar(255) not null
)
xxx;
$result = mysqli_query($link, $sql);
if (!$result) {
echo '执行失败'.mysqli_error($link);
}

// 创建客房外部信息 房间号 房间类型 房间电话 楼层 客房状态
$sql = <<<xxx
create table if not exists room(
room_id varchar(20) not null primary key,
type varchar(20) not null,
phone varchar(20) not null,
stair int not null,
status varchar(20) not null
)
xxx;
$result = mysqli_query($link, $sql);
if (!$result) {
echo '执行失败'.mysqli_error($link);
}

// 创建客房的内部信息 房间号 房间类型 价格 面积 额定床位 是否有电脑(yes/no)
$sql = <<<xxx
create table if not exists room_info(
room_id varchar(20) not null primary key,
type varchar(20) not null,
price int not null,
size double not null,
bed int not null,
computer varchar(20) not null
)
xxx;
$result = mysqli_query($link, $sql);
if (!$result) {
echo '执行失败'.mysqli_error($link);
}

// 创建入住信息表 订单流水号（先预定再入住） 客房号 入住日期 退房日期 押金 结账金额 消费金额
// 也许结账金额是正常金额，消费金额是优惠过后的？
$sql = <<<xxx
create table if not exists login(
order_id int not null primary key,
room_id varchar(20) not null,
in_time varchar(20) not null,
out_time varchar(20) not null,
credit_money int not null,
money int not null,
real_money int not null
)
xxx;
$result = mysqli_query($link, $sql);
if (!$result) {
echo '执行失败'.mysqli_error($link);
}

// 创建预定信息表 订单流水号 证件号 客房号 预定日期(yy-mm-dd) 预定入住日期(yy-mm-dd) 预定天数
$sql = <<<xxx
create table if not exists pre_order(
order_id int not null primary key auto_increment,
people_id varchar(20) not null,
room_id varchar(20) not null,
order_time varchar(20) not null,
use_time varchar(20) not null,
use_long_time int not null
)
xxx;
$result = mysqli_query($link, $sql);
if (!$result) {
echo '执行失败'.mysqli_error($link);
}

// 创建管理员账户数据表
$sql = <<<xxx
create table if not exists `admin`(
`user` varchar(20) not null primary key,
`pwdhash` varchar(255) not null,
`level` int not null
)
xxx;
$result = mysqli_query($link, $sql);
if (!$result) {
echo '执行失败'.mysqli_error($link);
}

// 查找管理员数据表中有没有root账户，没有则创建
$sql = 'select * from `admin`';
$result = mysqli_query($link, $sql);
if (!$result) {
echo '执行失败'.mysqli_error($link);
}
$result = $result->fetch_all();
$flag = false;
for ($i = 0; $i < count($result); $i++) {
if ($result[$i][0] == 'root') {
$flag = true;
}
}
if (!$flag) {
$pwdhash = crypt('123456', 'salt');
$sql = 'insert into `admin` values ("root", "'.$pwdhash.'", 1)';
$result = mysqli_query($link, $sql);
if (!$result) {
echo '执行失败'.mysqli_error($link);
}
}

// 查询数据库的root账户密码是不是123456，是则发出修改提醒
$sql = 'select * from `admin`';
$result = mysqli_query($link, $sql);
if (!$result) {
echo '执行失败'.mysqli_error($link);
}
$result = $result->fetch_all();
$flag = false;
for ($i = 0; $i < count($result); $i++) {
if ($result[$i][0] == 'root' && hash_equals($result[$i][1], crypt('123456', 'salt'))) {
$flag = true;
}
}
if ($flag) {
echo '<p>初始系统会自动创建root账户，密码123456，请及时修改账号密码！</p>';
}

// 有提交则判断账号密码错误或者正确
$errmsg = $user = $password = '';
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
$user = $_POST['user'];
$password = $_POST['password'];

$sql = 'select * from `admin`';
$result = mysqli_query($link, $sql);
if (!$result) {
echo '执行失败'.mysqli_error($link);
}
$result = $result->fetch_all();
$correct = false;
for ($i = 0; $i < count($result); $i++) {
if ($result[$i][0] == $user && hash_equals($result[$i][1], crypt($password, 'salt'))) {
$correct = true;
}
}
if (!$correct) {
$errmsg = '账号或密码错误，请检查后重新输入';
}
else {
// 跳转到后台页面
session_start();
$_SESSION['user'] = $user;
header('location: manager.php');
}

}

?>

<p><?php echo $errmsg; ?></p>
<form action="<?php echo $_SERVER['PHP_SELF'] ?>" method="post">
<table>
<tr>
<td><label for='user'>用户名：</label></td>
<td><input type='text' name='user' id='user' value='<?php echo $user?>' /></td>
</tr>
<tr>
<td><label for='password'>密码：</label></td>
<td><input type='password' name='password' id='password' value='<?php echo $password?>' /></td>
</tr>
<tr>
<td>
<input type="submit" value='登录'>
</td>
</tr>
</table>
</form>
<p>如果忘记root密码，请到数据库删除root账户条目</p>
175 changes: 175 additions & 0 deletions adminaccountmanager.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,175 @@
<title>管理员账户管理</title>

<?php
// 判断session有没有用户名，没有就是非法访问，要跳回去
session_start();
if (!isset($_SESSION['user'])) {
header('location: admin.php');
exit();
}

// 连接数据库
$link = mysqli_connect('localhost:3308', 'root', '', 'bigwork');
if (!$link) {
echo '数据库连接失败<br>';
exit();
}

// 获取当前账户权限等级，待会儿只能对权限比自己低的账户操作
$sql = 'select * from `admin`';
$result = mysqli_query($link, $sql);
if (!$result) {
echo '执行失败'.mysqli_error($link);
}
$result = $result->fetch_all();
for ($i = 0; $i < count($result); $i++) {
if ($result[$i][0] == $_SESSION['user']) {
$level = $result[$i][2];
}
}

// 处理post请求
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
if ($_POST['operate'] == 'create') {
// 判断设置的权限是不是合法
if ((int)$_POST['permission'] > $level) {
// 在数据库添加条目
$sqluser = $_POST['user'];
$sqlpwd = crypt($_POST['password'], 'salt');
$sql = 'insert into admin values ("'.$sqluser.'", "'.$sqlpwd.'", '.$_POST['permission'].')';
$result = mysqli_query($link, $sql);
if (!$result) {
echo '执行失败'.mysqli_error($link);
}
}
}
else if ($_POST['operate'] == 'edit') {
// 判断权限是否足够
if ((int)$_POST['permission'] > $level || $_POST['user'] == $_SESSION['user']) {
// 修改数据库条目
$sqlpwd = crypt($_POST['password'], 'salt');
$sql = 'update `admin` set `pwdhash`="'.$sqlpwd.'" where `user`="'.$_POST['user'].'"';
$result = mysqli_query($link, $sql);
if (!$result) {
echo '执行失败'.mysqli_error($link);
}
}
else {
echo '权限不足<br>';
}

}
else if ($_POST['operate'] == 'delete') {
// 判断权限是否足够
if ((int)$_POST['permission'] > $level) {
// 删除数据库条目
$sql = "delete from `admin` where `user`=\"".$_POST['user']."\"";
$result = mysqli_query($link, $sql);
if (!$result) {
echo '执行失败'.mysqli_error($link);
}
}
}
else {
echo 'post提交了奇怪的东西<br>';
var_dump($_POST);
}
}

?>

<h1>管理员账户管理</h1>
<table border="1">
<tr>
<th>当前用户</th>
<th>当前权限等级</th>
</tr>
<tr>
<td>
<?php echo $_SESSION['user']; ?>
</td>
<td>
<?php echo $level; ?>
</td>
</tr>
</table>

<h3>新建管理员</h3>
<table>
<form action="<?php echo $_SERVER['PHP_SELF'] ?>" method="post">
<input type="hidden" name="operate" value="create">
<tr><td><input type="text" placeholder="用户名" name="user"></td></tr>
<tr><td><input type="password" placeholder="密码" name="password"></td></tr>
<tr><td><input type="text" placeholder="权限（数字必须高于自身）" name="permission"></td></tr>
<tr><td><input type="submit" value="新建"></td></tr>
</form>
</table>

<h3>管理员账户列表</h3>
<table border="1">
<tr>
<th>用户名</th>
<th>权限</th>
<th>密码修改</th>
<th>账户删除</th>
</tr>

<?php
$sql = 'select * from `admin`';
$result = mysqli_query($link, $sql);
if (!$result) {
echo '执行失败'.mysqli_error($link);
}
$result = $result->fetch_all();
for ($i = 0; $i < count($result); $i++) {
echo '<tr>';
// 显示用户名
echo '<td>'.$result[$i][0].'</td>';
echo '<td>'.$result[$i][2].'</td>';

// 根据权限显示修改密码按钮（可修改自己或者权限比自己低的用户）
if ($level < $result[$i][2] || $result[$i][0] == $_SESSION['user']){
$self = $_SERVER['PHP_SELF'];
$editUser = $result[$i][0];
$sqlpermission = $result[$i][2];
echo <<<xxx
<form action="$self" method="post">
<td>
<input type="hidden" name="operate" value="edit">
<input type="hidden" name="user" value="$editUser">
<input type="hidden" name="permission" value="$sqlpermission">
<input type="text" name="password" placeholder="输入要修改的密码">
<input type="submit" value="修改密码">
</td>
</form>
xxx;
}
else {
echo "<td></td>";
}

// 根据权限显示账户删除按钮
if ($level < $result[$i][2]) {
$self = $_SERVER['PHP_SELF'];
$delUser = $result[$i][0];
$sqlpermission = $result[$i][2];
echo <<<xxx
<td>
<form action="$self" method="post">
<input type="hidden" name="operate" value="delete">
<input type="hidden" name="user" value="$delUser">
<input type="hidden" name="permission" value="$sqlpermission">
<input type="submit" value="删除账户">
</form>
</td>
xxx;
}
else {
echo "<td></td>";
}


echo '</tr>';
}
?>
</table>
Binary file added backup.zip
Binary file not shown.
10 changes: 10 additions & 0 deletions error.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
<?php
header('content-type:text/html;charset=utf-8');
echo '<h1>';
echo $_GET['message'];
echo '</h1>';

if (isset($_GET['url'])) {
echo "<a href=\"{$_GET['url']}\">{$_GET['note']}</a>";
}
?>
Loading

0 comments on commit 68a6fb8

Please sign in to comment.