[TOC] ## `www.openpoor.com/index.php`(登陸系統) ``` <?php session_start(); if(empty($_SESSION['username'])): ?> hello,游客;請先<a href="login.php" rel="external nofollow" >登錄</a> <a href="http://www.myspace.com/index.php" rel="external nofollow" rel="external nofollow" >進入空間</a> <?php else: ?> hello, <?php echo $_SESSION['username']; ?>; <a href="http://www.myspace.com/index.php" rel="external nofollow" rel="external nofollow" >進入空間</a> <?php endif; ?> <a href="http://www.openpoor.com/index.php" rel="external nofollow" >home</a> ``` 未登錄  登錄后  ## `www.openpoor.com/login.php`(登陸系統)登陸頁面 ``` //接受登錄頁面提交的用戶數據（這里提交到本頁面） <?php session_start(); if(!empty($_POST['username'])){ require '../Des.php';//用于加密解密用戶數據 $_SESSION['username'] = $_POST['username']; $redirect = 'http://www.openpoor.com/index.php';//登錄成功后跳轉的地址 header('Location:http://www.openpoor.com/sync.php?redirect='.urlencode($redirect).'&code='.Des::encrypt($_POST['username'],'openpoor'));exit; } ?> <form action="" method="post"> <input type="text" name="username" placeholder="用戶名"/> <input type="text" name="password" placeholder="密碼"/> <input type="submit" value="登錄"/> </form> ``` ## `www.openpoor.com/sync.php`(登陸系統) ``` <?php $redirect = empty($_GET['redirect']) ? 'www.openpoor.com' : $_GET['redirect']; //code參數不存在跳轉回登錄頁面 if(empty($_GET['code'])){ header('Loaction:http://'.urldecode($redirect)); exit; } $apps = array( 'www.myspace.com/slogin.php' ); foreach($apps as $v): ?> //src里放php可以跨域請求資源，注意：所引用的.php文件最終形成的是js類型代碼 <script type="text/javascript" src="http://<?php echo $v.'?code='.$_GET['code'] ?>"></script> <?php endforeach; ?> <script type="text/javascript"> window.onload=function(){ location.replace('<?php echo $redirect; ?>'); } </script> </body> ``` `www.myspace.com`/slogin.php(子系統) ``` <?php session_start(); header('Content-Type:text/javascript; charset=utf-8'); if(!empty($_GET['code'])){ require '../Des.php'; $username = Des::decrypt($_GET['code'],'openpoor'); if(!empty($username)){ //在php被請求的頁面加上以下代碼，就可以跨域獲取cookie，但其安全性有待研究 header('P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"'); $_SESSION['username'] = $username; } } ?> ``` `www.myspace.com`/index.php(子系統) ``` <?php session_start(); if(!empty($_SESSION['username'])) { echo "歡迎來到".$_SESSION['username']."的空間"; }else{ echo "請先登錄"; } ?> ```   `www.myspace.com`/Des.php ``` <?php /** *@see Yii CSecurityManager; */ class Des{ public static function encrypt($data,$key){ $module=mcrypt_module_open('des','', MCRYPT_MODE_CBC,''); $key=substr(md5($key),0,mcrypt_enc_get_key_size($module)); srand(); $iv=mcrypt_create_iv(mcrypt_enc_get_iv_size($module), MCRYPT_RAND); mcrypt_generic_init($module,$key,$iv); $encrypted=$iv.mcrypt_generic($module,$data); mcrypt_generic_deinit($module); mcrypt_module_close($module); return md5($data).'_'.base64_encode($encrypted); } public static function decrypt($data,$key){ $_data = explode('_',$data,2); if(count($_data)<2){ return false; } $data = base64_decode($_data[1]); $module=mcrypt_module_open('des','', MCRYPT_MODE_CBC,''); $key=substr(md5($key),0,mcrypt_enc_get_key_size($module)); $ivSize=mcrypt_enc_get_iv_size($module); $iv=substr($data,0,$ivSize); mcrypt_generic_init($module,$key,$iv); $decrypted=mdecrypt_generic($module,substr($data,$ivSize,strlen($data))); mcrypt_generic_deinit($module); mcrypt_module_close($module); $decrypted = rtrim($decrypted,"\0"); if($_data[0]!=md5($decrypted)){ return false; } return $decrypted; } } ?> ```