PHP password_verify似乎使用的是一个字符串，而不是另一个被认为是相等的字符串。

Question

我将用户名和加密密码存储在mysql数据库中。仅用于测试时，我还将密码以未加密的形式存储在数据库中。

在下面的代码中，我从数据库获得散列密码和未加密密码。然后对未加密的密码进行加密。

给定密码不会通过存储散列或新哈希的密码验证测试。

存储的密码确实通过了存储散列和新哈希的密码验证测试。

对strcmp的调用表示存储的密码与给定的密码相等。

这怎么可能是？

编辑:我是从网页上的用户输入传入$password。

// get hashed password from database
$sql = "SELECT member_password FROM member WHERE member_username=:username;";
$stmt = $db->prepare($sql);
$stmt->bindParam("username", $username);
$stmt->execute();
$hash = $stmt->fetch(PDO::FETCH_ASSOC);
$hash = $hash["member_password"];

// get unencrypated password from database
$sql = "SELECT member_unencrypted FROM member WHERE member_username=:username;";
$db = getConnection();
$stmt = $db->prepare($sql);
$stmt->bindParam("username", $username);
$stmt->execute();
$unencrypted = $stmt->fetch(PDO::FETCH_ASSOC);
$unencrypted = $unencrypted["member_unencrypted"];

// encrypt the unencrypted password that was retrieved from the database
$encrypted = password_hash($unencrypted, PASSWORD_DEFAULT);

// given password does not pass the new hash per this test
if(password_verify($password, $encrypted))
  echo '<br>given password passed new hash';
else 
  echo '<br>given password did not pass new hash';

// stored password does pass the new hash per this test
if(password_verify($unencrypted, $encrypted))
  echo '<br>stored password passed new hash';
else
  echo '<br>stored password did not pass new hash';

// given password does not pass the stored hash per this test.
if(password_verify($password, $hash)){
  echo '<br>given password passed stored hash';
else
  echo '<br>given password did not pass stored hash';

// stored password does pass the stored hash per this test.
if(password_verify($unencrypted, $hash))
  echo '<br>stored password passed stored hash';
else
  echo '<br>stored password did not pass stored hash';

// stored and given passwords are equal per this test.
if(strcmp($unencrypted, $password)) 
  echo '<br>stored and given passwords are equal';
else
  echo '<br>stored and given passwords are not equal';

输出：

given password did not pass new hash
stored password passed new hash
given password did not pass stored hash
stored password passed stored hash
stored and given passwords are equal

Answer 1

从您的问题中不清楚变量$password来自何处，以及它是否包含与存储在数据库中的变量相同的文本。

如果进行这样的测试，您必须知道函数password_hash()将生成唯一的salt，并将其包含在结果的哈希中。为了进行验证，您需要这个salt (和其他参数)来获得一个可比的散列值。这意味着每次哈希将是不同的，如果您两次调用password_hash()，您将得到不同的盐类和不可比较的散列。

我试图用另一个answer解释哈希格式。

编辑从布鲁斯:见评论的答案