php - 数据库中的加密密码存储但显然错误?
问题描述
我使用教程创建了一个简单的登录,该教程在教程中使用 md5 进行加密,而不是 md5 我使用了 password_hash,
$password = password_hash("$password_1", PASSWORD_DEFAULT);
它可以工作并将加密密码存储在我的数据库中,但是当我尝试使用非加密密码登录时,我得到“输入用户名或密码”,我使用的代码如下 - 只有我删除了我的服务器信息:
<?php
session_start();
// initializing variables
$username = "";
$email = "";
$errors = array();
// REGISTER USER
if (isset($_POST['reg_user'])) {
// receive all input values from the form
$username = mysqli_real_escape_string($db, $_POST['username']);
$email = mysqli_real_escape_string($db, $_POST['email']);
$password_1 = mysqli_real_escape_string($db, $_POST['password_1']);
$password_2 = mysqli_real_escape_string($db, $_POST['password_2']);
// form validation: ensure that the form is correctly filled ...
// by adding (array_push()) corresponding error unto $errors array
if (empty($username)) { array_push($errors, "Username is required"); }
if (empty($email)) { array_push($errors, "Email is required"); }
if (empty($password_1)) { array_push($errors, "Password is required"); }
if ($password_1 != $password_2) {
array_push($errors, "The two passwords do not match");
}
// first check the database to make sure
// a user does not already exist with the same username and/or email
$user_check_query = "SELECT * FROM users WHERE username='$username' OR
email='$email' LIMIT 1";
$result = mysqli_query($db, $user_check_query);
$user = mysqli_fetch_assoc($result);
if ($user) { // if user exists
if ($user['username'] === $username) {
array_push($errors, "Username already exists");
}
if ($user['email'] === $email) {
array_push($errors, "email already exists");
}
}
// Finally, register user if there are no errors in the form
if (count($errors) == 0) {
$password = password_hash("$password_1", PASSWORD_DEFAULT);//encrypt the
password before saving in the database
$query = "INSERT INTO users (username, email, password)
VALUES('$username', '$email', '$password')";
mysqli_query($db, $query);
$_SESSION['username'] = $username;
$_SESSION['success'] = "You are now logged in";
header('location: testlogin.php');
}
}
// ...
// LOGIN USER
if (isset($_POST['login_user'])) {
$username = mysqli_real_escape_string($db, $_POST['username']);
$password = mysqli_real_escape_string($db, $_POST['password']);
if (empty($username)) {
array_push($errors, "Username is required");
}
if (empty($password)) {
array_push($errors, "Password is required");
}
if (count($errors) == 0) {
$password = password_hash("$password", PASSWORD_DEFAULT);
$query = "SELECT * FROM users WHERE username='$username' AND
password='$password'";
$results = mysqli_query($db, $query);
if (mysqli_num_rows($results) == 1) {
$_SESSION['username'] = $username;
$_SESSION['success'] = "You are now logged in";
header('location: testlogin.php');
}else {
array_push($errors, "Wrong username/password combination");
}
}
}
?>
我需要包括什么东西才能让 password_hash 正常工作吗?
解决方案
验证用户密码时,需要使用该password_verify
功能。我在下面调整了您的登录代码:
if (count($errors) == 0) {
$query = "SELECT * FROM users WHERE username='$username'";
$result = mysqli_query($db, $query);
if (mysqli_num_rows($result) === 1) {
$user = mysqli_fetch_assoc($result);
if (password_verify($password, $user['password'])) {
$_SESSION['username'] = $username;
$_SESSION['success'] = "You are now logged in";
header('Location: testlogin.php');
die();
}
}
array_push($errors, "Wrong username/password combination");
}
推荐阅读
- vba - 在 Access 365 表单上使用 avicap32 进行网络摄像头捕获适用于单摄像头笔记本电脑(64 位),2 摄像头平板电脑(32 位)上的图片框中出现黑屏
- android - ConstrainLayout 不在 NestedScrollview 内滚动
- javascript - 我可以告诉有人在我的网站之前访问的最后一个网站吗?
- authentication - 实现应用认证的准确方法是什么
- python - 如何控制免费高级 twitter api 的速率限制
- image - 使用 WSO2 EI 文件连接器无法查看下载的图像
- amazon-web-services - 使用 X 射线跟踪 AWS 中的公共服务
- html - 在不使用 webpack 的情况下需要 HTML 文件中的 CSS 文件
- visual-studio-2015 - 如何让一组审阅者对 Azure Dev Ops 项目允许通过 Microsoft Visual Studio 2017 中的团队资源管理器进行代码审阅
- javascript - 将属性添加到自定义数组数据类型时出现 TypeError