时间戳

首页 > 解决方案 > 在 PHP 和 MYSQL 的输入中从数据库中的哈希密码中获取原始密码

php - 在 PHP 和 MYSQL 的输入中从数据库中的哈希密码中获取原始密码

问题描述

我有一个用户页面，其中有添加和编辑用户信息，我试图从 PHP 和 MYSQL 的输入中的数据库中的散列密码中获取原始密码。我试过这段代码：

if(isset($_GET['add']) || isset($_GET['edit'])){
    $name = ((isset($_POST['name']))?sanitize($_POST['name']):'');
    $email = ((isset($_POST['email']))?sanitize($_POST['email']):'');
    $password = ((isset($_POST['password']))?sanitize($_POST['password']):'');
    $confirm = ((isset($_POST['confirm']))?sanitize($_POST['confirm']):'');
    $permissions = ((isset($_POST['permissions']))?sanitize($_POST['permissions']):'');
    $errors = array();
    if(isset($_GET['edit'])){
      $edit_id = (int)$_GET['edit'];
      $userResults = $db->query("SELECT * FROM users WHERE id = '$edit_id'");
      $user = mysqli_fetch_assoc($userResults);
      $name = ((isset($_POST['name']))?$_POST['name']:$user['full_name']);
      $email = ((isset($_POST['email']))?$_POST['email']:$user['email']);
      $password = ((isset($_POST['password']))?$_POST['password']:$user['password']);
      $confirm = ((isset($_POST['confirm']))?sanitize($_POST['confirm']):'');
      $permissions = ((isset($_POST['permissions']))?$_POST['permissions']:$user['permissions']);
    }

    if($_POST){
      $emailQuery = $db->query("SELECT * FROM users WHERE email = '$email'");
      $emailCount = mysqli_num_rows($emailQuery);


      if($emailCount != 0 && $_GET['add']){
        $errors[] = 'That email already exists in our database.';
      }

      $required = array('name', 'email', 'password', 'confirm', 'permissions');
      foreach($required as $f){
        if(empty($_POST[$f])){
          $errors[] = 'You must fill out all fields.';
          break;
        }
      }
      if(strlen($password) < 6){
        $errors[] = 'Your password must be at least 6 characters.';
      }

      if($password != $confirm){
        $errors[] = 'Your passwords do not match.';
      }

      if(!filter_var($email,FILTER_VALIDATE_EMAIL)){
        $errors[] = 'You must enter a valid email.';
      }

      if(!empty($errors)){
        echo display_errors($errors);
      }else{
        //add user to database
        $hashed = password_hash($password,PASSWORD_DEFAULT);
        $mql = "INSERT INTO users (full_name,email,password,permissions) VALUES ('$name','$email','$hashed','$permissions')";
        $_SESSION['success_flash'] = $name.' has been added.';
        if(isset($_GET['edit'])){
          $mql = "UPDATE users SET `full_name` = '$name', `email` = '$email',
          `password` = '$hashed', `permissions` = '$permissions'
          WHERE id = '$edit_id'";
        }
        $db->query($mql);
        header('Location: users.php');
      }
    }
<h3 class="text-center"><?=((isset($_GET['edit']))?'Edit':'Add A New');?> User</h3><hr>
    <form action="users.php?<?=((isset($_GET['edit']))?'edit='.$edit_id:'add=1');?>" method="post">
<div class="row">
      <div class="form-group col-lg-6">
        <label for="password">Password:</label>
        <input type="text" name="password" id="password" class="form-control" value="<?php if(password_verify($password, $user['password'])){echo $password;}?>">
      </div>
}else{
// Add user HTML

但是输入是空的......我似乎无法在代码中找到错误。如果我删除password verifyHTML 中的代码并将其替换为<?=$password;?>我得到的是散列密码而不是原始密码。除确认和密码外，所有字段均有效。

标签： phppassword-hash

解决方案

你不能。哈希是一种单向函数。这就是它的目的。https://en.wikipedia.org/wiki/Hash_function

推荐阅读