PHP 文件读取与安全渲染：CSV 解析、UTF-8 与 HTML 输出

id|name|age|email|website
1|示例读者|20|reader@example.com|https://example.com/
2|另一位读者|31|second@example.net|

<?php
declare(strict_types=1);

function readPeople(string $filePath): array
{
    $handle = fopen($filePath, 'rb');
    if ($handle === false) {
        throw new RuntimeException('无法打开人员数据文件');
    }

    try {
        $headers = fgetcsv($handle, 0, '|', '"', '');
        if ($headers === false) {
            return [];
        }

        if (isset($headers[0])) {
            $headers[0] = preg_replace('/^\xEF\xBB\xBF/', '', (string) $headers[0]) ?? (string) $headers[0];
        }
        $headers = array_map(static fn ($value): string => trim((string) $value), $headers);
        $expectedHeaders = ['id', 'name', 'age', 'email', 'website'];
        if ($headers !== $expectedHeaders) {
            throw new UnexpectedValueException('数据文件表头不符合约定');
        }

        $people = [];
        $lineNumber = 1;
        while (($columns = fgetcsv($handle, 0, '|', '"', '')) !== false) {
            $lineNumber++;
            if ($columns === [null]) {
                continue;
            }
            if (count($columns) !== count($expectedHeaders)) {
                throw new UnexpectedValueException("第 {$lineNumber} 行字段数量不正确");
            }

            $row = array_combine(
                $expectedHeaders,
                array_map(static fn ($value): string => trim((string) $value), $columns),
            );

            $id = filter_var($row['id'], FILTER_VALIDATE_INT, ['options' => ['min_range' => 1]]);
            $age = filter_var($row['age'], FILTER_VALIDATE_INT, ['options' => ['min_range' => 0, 'max_range' => 130]]);
            $email = filter_var($row['email'], FILTER_VALIDATE_EMAIL);
            if ($id === false || $age === false || $email === false || $row['name'] === '') {
                throw new UnexpectedValueException("第 {$lineNumber} 行包含无效字段");
            }

            $website = $row['website'];
            if ($website !== '') {
                $parts = parse_url($website);
                $scheme = is_array($parts) ? strtolower((string) ($parts['scheme'] ?? '')) : '';
                if (filter_var($website, FILTER_VALIDATE_URL) === false
                    || $scheme !== 'https'
                    || empty($parts['host'])
                    || isset($parts['user'])
                    || isset($parts['pass'])) {
                    throw new UnexpectedValueException("第 {$lineNumber} 行的网址必须是有效的 HTTPS 地址");
                }
            }

            $people[] = [
                'id' => $id,
                'name' => $row['name'],
                'age' => $age,
                'email' => $email,
                'website' => $website,
            ];
        }

        return $people;
    } finally {
        fclose($handle);
    }
}

function escapeHtml(string $value): string
{
    return htmlspecialchars($value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
}

$loadError = null;
try {
    $people = readPeople(__DIR__ . '/data/people.csv');
} catch (Throwable $error) {
    error_log('People table could not be loaded: ' . $error->getMessage());
    $people = [];
    $loadError = '列表暂时不可用，请稍后再试。';
}
?>
<!doctype html>
<html lang="zh-CN">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>人员信息表</title>
</head>
<body>
    <main>
        <h1>人员信息表</h1>
        <?php if ($loadError !== null): ?>
            <p role="status"><?= escapeHtml($loadError) ?></p>
        <?php else: ?>
            <table>
                <thead>
                    <tr><th scope="col">编号</th><th scope="col">姓名</th><th scope="col">年龄</th><th scope="col">邮箱</th><th scope="col">个人主页</th></tr>
                </thead>
                <tbody>
                    <?php foreach ($people as $person): ?>
                        <tr>
                            <td><?= escapeHtml((string) $person['id']) ?></td>
                            <td><?= escapeHtml($person['name']) ?></td>
                            <td><?= escapeHtml((string) $person['age']) ?></td>
                            <td><?= escapeHtml($person['email']) ?></td>
                            <td>
                                <?php if ($person['website'] !== ''): ?>
                                    <?php $host = (string) parse_url($person['website'], PHP_URL_HOST); ?>
                                    <a href="<?= escapeHtml($person['website']) ?>" target="_blank" rel="noopener noreferrer"><?= escapeHtml($host) ?></a>
                                <?php else: ?>
                                    <span>未填写</span>
                                <?php endif; ?>
                            </td>
                        </tr>
                    <?php endforeach; ?>
                </tbody>
            </table>
        <?php endif; ?>
    </main>
</body>
</html>