up

admin/index.php

@@ -1,5 +1,6 @@
 <?php
 session_start();
+require_once '../includes/db.php';
 
 // 如果已登录，跳转到管理面板
 if (isset($_SESSION['admin_logged_in']) && $_SESSION['admin_logged_in'] === true) {
@@ -14,10 +15,15 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     $username = $_POST['username'] ?? '';
     $password = $_POST['password'] ?? '';
 
-    // 简单的硬编码验证（默认 admin/admin）
-    if ($username === 'admin' && $password === 'admin') {
+    // 从数据库验证用户
+    $stmt = $db->prepare("SELECT * FROM users WHERE username = ?");
+    $stmt->execute([$username]);
+    $user = $stmt->fetch(PDO::FETCH_ASSOC);
+
+    if ($user && password_verify($password, $user['password'])) {
         $_SESSION['admin_logged_in'] = true;
         $_SESSION['username'] = $username;
+        $_SESSION['user_id'] = $user['id'];
         header('Location: dashboard.php');
         exit;
     } else {