update

core/router.php

@@ -5,6 +5,7 @@ if ($api_class == 'admin') {
         // 处理管理员请求
         // ...
     } else {
+        http_response_code(401)
         echo json_encode(['error' => 'Unauthorized', 'code' => 401]);
         exit;
     }
@@ -15,6 +16,7 @@ elseif ($api_class != 'admin') {
         // 处理已登录用户请求
         // ...
     } else {
+        http_response_code(401)
         echo json_encode(['error' => 'Unauthorized', 'code' => 401]);
         exit;
     }

index.php

@@ -1,19 +1,44 @@
-<?php 
+<?php
 include 'core/config.php';
 include 'core/clean.php';
 
-// TODO: cookie manage
+// TODO: cookie management
 session_start();
 
-// 获取参数
+// 获取参数并清理
 $api_class = isset($_GET['class']) ? sanitizeInput($_GET['class']) : '';
-$api = isset($_GET['api']) ? sanitizeInput($_GET['api']) : ''; 
+$api = isset($_GET['api']) ? sanitizeInput($_GET['api']) : '';
 
-// 如果不是 public api 则启用路由
+// 设置响应头
+header("Content-Type: application/json");
+
+if (empty($api_class)) {
+    http_response_code(200); // Bad Request
+    echo json_encode(array('status' => 'Home page'));
+    exit();
+}
+// 验证输入是否符合预期格式
+elseif (!preg_match('/^[a-zA-Z0-9_]+$/', $api_class) || !preg_match('/^[a-zA-Z0-9_]+$/', $api)) {
+    http_response_code(400); // Bad Request
+    echo json_encode(array('error' => 'Invalid input'));
+    exit();
+}
+
+// 构建文件路径
+$file_path = 'includes/' . $api_class . '/' . $api . '.php';
+
+// 检查文件是否存在
+if (!file_exists($file_path)) {
+    http_response_code(404); // Not Found
+    echo json_encode(array('error' => '404 Not Found', 'message' => 'The requested resource could not be found'));
+    exit();
+}
+
+// 如果不是 public API，则启用路由
 if ($api_class != 'public') {
     include 'core/login_router.php';
 }
 
-header("Content-Type: application/json");
-include 'includes/' . $api_class . '/' . $api . '.php';
-
+// 包含文件
+include $file_path;
+?>