python - AES_ENCRYPT() 和 AES_DECRYPT 无法正常使用 xampp 服务器和 python 烧瓶将值存储在 mysql 中

Question

我正在学习 python 烧瓶并开发一个网页，我可以在其中使用 XAMPP 服务器在 MySQL 数据库中以加密格式注册和存储用户详细信息，并在登录期间对其进行解密以验证用户详细信息。

在这里，在将加密密码存储在数据库中时，该AES_ENCRYPT函数正在加密字符串“密码”本身，而不是在表单中输入的密码。并且该AES_DECRYPT函数在登录验证过程中不会取回字符串，所以它总是显示无效密码。如何解决这个问题？

from flask import Flask, request, render_template
app = Flask(__name__)

import mysql.connector as MySQLdb

@app.route('/')
@app.route('/login')
def login():
    return render_template('login.html')

@app.route('/register')
def register():
    return render_template('register.html')

def valid_login(uname, password):
    # Open database connection
    db = MySQLdb.connect(
        host="localhost",
        user="root",
        passwd="",
        database="sam"
    )

    cursor = db.cursor()
    sql = "SELECT AES_DECRYPT(AES_ENCRYPT('passcode', 'usa2010'), 'usa2010') FROM user WHERE username = %s"

    value =(uname, )
    cursor.execute(sql, value)
    row = cursor.fetchone()

    print(row[0])
    if password == row[0].decode():
        return 1
    else:
        return 0

    # disconnect from server
    db.close()

def valid_insert(uname, email, password, phone, city):
    # Open database connection
    db = MySQLdb.connect(
        host="localhost",
        user="root",
        passwd="",
        database="sam"
    )
    cursor = db.cursor()
    sql = "INSERT INTO user VALUES (%s, %s, AES_ENCRYPT(password, 'usa2010'), %s, %s)"

    val = (uname, email, phone, city)
    cursor.execute(sql, val)
    db.commit()

    if cursor.rowcount > 0:
        return 1
    else:
        return 0

    # disconnect from server
    db.close()

@app.route('/check', methods=['POST'])
def check():
    error = None
    if request.method == 'POST':
        if valid_login(request.form['uname'], request.form['pass']):
            return render_template('home.html')
        else:
            print('Invalid username/password')
    return render_template('login.html')

@app.route('/login_insert', methods=['POST'])
def insert():
    error = None
    if request.method == 'POST':
        if valid_insert(request.form['uname'], request.form['email'], request.form['pass'], request.form['phone'], request.form['city']):
            return render_template('login.html')
        else:
            error = 'Username already taken.'
    return render_template('register.html')


if __name__ == '__main__':
    app.run()

标签： pythonmysqlsqlcryptographyaes