blocks|key|3832060|text|确保密码存储方案安全的最简单方法是使用标准库的。|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|3832061|因为安全性往往比大多数程序员单独处理要复杂得多，并且具有更多看不见的混乱可能性，所以使用标准库几乎总是最简单和最安全的(如果不是唯一可用的选择)。|3832062|有关更多信息，请参阅this+answer|3832063|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/questions/1581610/help-me-make-my-password-storage-safe/1581919#1581919^0|N|1|0|0|21|0|0|L|A|B|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@$9|S|A|T|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|U|8|@$9|V|A|W|B|C]]|D|@]|E|$]]|$1|H|3|I|5|6|7|X|8|@$9|Y|A|Z|B|C]]|D|@$9|10|A|11|1|12]]|E|$]]|$1|J|3|-4|5|6|7|13|8|@]|D|@]|E|$]]]|K|$L|$5|M|N|O|E|$P|Q]]]]

The easiest way to get your password storage scheme secure is by using a standard library.

Because security tends to be a lot more complicated and with more invisible screw up possibilities than most programmers could tackle alone, using a standard library is almost always easiest and most secure (if not the only) available option.

See <a href="https://stackoverflow.com/questions/1581610/help-me-make-my-password-storage-safe/1581919#1581919">this answer</a> for more info

blocks|key|3831894|text|您需要使用适当的安全算法对密码进行加密和散列。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3831895|3831896|PHP的mhash在SO|unordered-list-item|offset|length|3831897|上有适当的散列functions|3831898|A+full+example|3831899|3831900|entityMap|0|LINK|mutability|MUTABLE|url|http://au.php.net/mhash|1|https://stackoverflow.com/questions/401656/secure-hash-and-salt-for-php-passwords^0|0|0|4|5|0|0|0|0|E|1|0|0^^$0|@$1|2|3|4|5|6|7|W|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|X|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|Y|8|@]|9|@$F|Z|G|10|1|11]]|A|$]]|$1|H|3|I|5|6|7|12|8|@]|9|@]|A|$]]|$1|J|3|K|5|E|7|13|8|@]|9|@$F|14|G|15|1|16]]|A|$]]|$1|L|3|-4|5|6|7|17|8|@]|9|@]|A|$]]|$1|M|3|-4|5|6|7|18|8|@]|9|@]|A|$]]]|N|$O|$5|P|Q|R|A|$S|T]]|U|$5|P|Q|R|A|$S|V]]]]

You need to salt and hash the password, using an appropriately secure algorithm.

<ul>
<li>PHP's <a href="http://au.php.net/mhash" rel="nofollow noreferrer">mhash</a> has appropriate hashing functions</li>
<li><a href="https://stackoverflow.com/questions/401656/secure-hash-and-salt-for-php-passwords">A full example</a> here on SO</li>
</ul>

blocks|key|3831872|text|您可能想要散列密码-而不是加密它。Check+out+SHA-1。散列意味着您不能像使用加密那样检索原始数据。相反，您要做的是对用户输入进行散列，并将其与数据库中的散列进行比较，以查看他们是否获得了正确的密码。这样做可以提高安全性，就好像您的数据库曾经被破坏过一样--一堆散列是无用的。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|3831873|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/SHA-1^0|H|F|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

You probably want to hash the password - not encrypt it. <a href="http://en.wikipedia.org/wiki/SHA-1" rel="nofollow">Check out SHA-1</a>. Hashing means that you cannot retrieve the original data as you can with encryption. Instead what you do is hash the users input and compare it to the hash in the database to see if they've got the right password. Doing this increases security as if your database was ever compromised - a bunch of hashes are useless.

blocks|key|2235293|text|保存MD5散列并使其更安全，请添加盐。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2235294|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/MD5^0|2|3|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

Save an <a href="http://en.wikipedia.org/wiki/MD5" rel="nofollow">MD5</a> hash and to make it more secure, add a salt.

blocks|key|1434965|text|嗯，你不应该用MD5加密它们(它不是真正安全的，大多数黑客都有转换表)。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1434966|因此，您可以使用SHA1+(通常使用)对其进行散列。|1434967|如果你想要更高的安全性，你可以添加更多的salt，这是一个你可以像这样添加的密钥(只是一个例子，通常使用)：|offset|length|style|CODE|1434968|salt%2Bsha1(salt%2Bpass)|code-block|syntax|javascript|1434969|这种组合可以与多种语言一起使用。|1434970|entityMap^0|0|0|K|4|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|T|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|U|8|@$F|V|G|W|H|I]]|9|@]|A|$]]|$1|J|3|K|5|L|7|X|8|@]|9|@]|A|$M|N]]|$1|O|3|P|5|6|7|Y|8|@]|9|@]|A|$]]|$1|Q|3|-4|5|6|7|Z|8|@]|9|@]|A|$]]]|R|$]]

Well, you shouldn't encrypt them with MD5 (which is not really secured, most hackers have conversion tables).

Hence, you can hash it with SHA1 (which is usually used).

If you want more security, you can add more <code>salt</code> which is a key you can add like this (just an example, usually used) :

<pre><code>salt+sha1(salt+pass)
</code></pre>

This combination can be used with many language.

blocks|key|1433469|text|SHA-1+(sha1+php内置函数)中的散列密码，带有几次递归的加盐(上面答案中的相同代码，只是循环了几次)。这应该是足够的保护，所以即使入侵者以某种方式获得了散列，他们也不应该能够破解它们……|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1433470|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Hash passwords in SHA-1 (sha1 php inbuilt function) with several recursions of salting (same code in the answers above, only loop through several times). This should be sufficient protection, so even if the intruders somehow get their hands on the hashes, they shouldn't be able to crack them...

blocks|key|3831975|text|有可能对密码进行散列(最好使用盐)：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3831976|$salt+=+random_string($length+=+5);
$hash+=+$salt+.+sha1($salt+.+$password);|code-block|syntax|javascript|3831977|或加密存储(仅当您的MySQL连接受SSL保护时)：|3831978|INSERT+INTO+`user`+(`user`,`pass`)+VALUES("username",ENCRYPT("password","secretkey"))|3831979|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|N|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|O|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

There is the possibility to hash passwords (preferably with a salt):

<pre><code>$salt = random_string($length = 5);
$hash = $salt . sha1($salt . $password);
</code></pre>

Or store encrypted (only if your MySQL connection is SSL secured):

<pre><code>INSERT INTO `user` (`user`,`pass`) VALUES("username",ENCRYPT("password","secretkey"))
</code></pre>

I'm developing a web service where users must login. I will store user data in an <a href="http://en.wikipedia.org/wiki/SQL" rel="nofollow">SQL</a> database and input/output via <a href="http://en.wikipedia.org/wiki/PHP" rel="nofollow">PHP</a>. But I don't want to store it openly. How do I encrypt the passwords in PHP so only those who knows the password can unlock it?

I know services like <a href="http://en.wikipedia.org/wiki/PhpBB" rel="nofollow">phpBB</a> uses some sort of hiding/encryption on stored passwords.

Secure password storage

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

EdgeOne AI 安全实战专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我正在开发一个用户必须登录的web服务。我将用户数据存储在数据库中，并通过进行输入/输出。但我不想公开地存储它。如何在PHP中加密密码，以便只有知道密码的人才能解锁？我知道像这样的服务会对存储的密码进行某种隐藏/加密。

问安全的密码存储
EN

回答 7

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问安全的密码存储EN

回答 7

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问安全的密码存储
EN