PHP password_hash()，password_verify()

Question

我的注册脚本接受用户的密码，然后使用PHP的password_hash函数加密密码，然后将其放在数据库中。当我使用刚刚创建的用户登录时，我得到的错误是检查密码是否相同。就我而言，他们不是。当我在登录脚本中调用password_verify函数时，我做错了什么？

寄存器

if($_SERVER["REQUEST_METHOD"] == "POST"){
    function secure($data){
        $data = trim($data);
        $data = stripslashes($data);
        $data = htmlspecialchars($data);
        return($data);
    }

    $p_num = secure($_POST["p_number"]);
    $first_name = secure($_POST["first_name"]);
    $last_name = secure($_POST["last_name"]);
    $email = secure($_POST["email"]);
    $password = secure($_POST["pw"]);
    $verify_password = secure($_POST["pw_verify"]);
    $program = secure($_POST["program"]);
    $role = secure($_POST["role"]);
    $logged_in = 0;
    $registered = 0;
    $image = "../images/profile_placeholder.png";

    if($password != $verify_password){
        echo "Nope.  Passwords";
    }
    else{
        $registered = 1;
        $password = password_hash($password, PASSWORD_DEFAULT);
        $insert = "INSERT INTO `$user_table`(`user_id`, `first_name`, `last_name`, `password`, `image`, `email`, `program`, `role`, `logged_in`, `registered`) VALUES('" .$p_num ."', '" .$first_name ."', '" .$last_name ."', '" .$password ."', '" .$image ."', '" .$email ."', '" .$program ."', '" .$role ."', '" .$logged_in ."', '" .$registered ."')";
        $query = mysqli_query($connect, $insert);
        echo "Success!";
    }
}

登录

if($_SERVER["REQUEST_METHOD"] == "POST"){
    $p_num = $_POST["username"];
    $pwd = $_POST["password"];

    $query = "SELECT * FROM `$user_table` WHERE `user_id` = '$p_num'";
    $result = mysqli_query($connect, $query);
    while($row = mysqli_fetch_assoc($result)){
        $user_id = "{$row['user_id']}";
        $first_name = "{$row['first_name']}";
        $last_name = "{$row['last_name']}";
        $user_name = $first_name ." " .$last_name;
        $password = "{$row['password']}";
        $image = "{$row['image']}";
        $email = "{$row['email']}";
        $program = "{$row['program']}";
        $role = "{$row['role']}";
        $status = "{$row['logged_in']}";
        $registered = "{$row['registered']}";
        if(($user_id == $p_num) && (password_verify($pwd, $password))){
            $_SESSION["id"] = $user_id;
            $_SESSION["user"] = $user_name;
            $_SESSION["program"] = $program;
            $_SESSION["pass"] = $password;
            $_SESSION["image"] = $image;
            $_SESSION["email"] = $email;
            $_SESSION["role"] = $role;
            $_SESSION["status"] = $status;
            $_SESSION["registered"] = $registered;
            $loggedin = "UPDATE `$user_table` SET `logged_in` = 1 WHERE `user_id` = '$user_id'";
        }
    var_dump($pwd);
    var_dump($password);
}

下面是我在做var_dump时得到的结果：

string(1) "1" string(16) "$2y$10$0aysCso3b"

所以很明显，密码是不匹配的。因此，在注册脚本上，密码被散列并发送到数据库。然后，当用户登录时，登录脚本将查看用户输入的登录密码，然后使用password_verify对数据库中的散列密码进行检查。然而，散列密码不接受未散列密码作为匹配。我不明白的是，为什么？

Answer 1

下面是我为password_hash和password_verify使用的内容。如果按照编写的方式进行尝试，那么一旦成功，您就可以开始添加其余的代码。

修改表和列名以适应。

N.B.:，这是一种基本的插入方法。我建议你用prepared statements代替。

Sidenote:密码列需要足够长以容纳散列VARCHAR(255)。参阅“脚注”。

插入文件

<?php
$DB_HOST = 'xxx';
$DB_USER = 'xxx';
$DB_PASS = 'xxx';
$DB_NAME = 'xxx';

$conn = new mysqli($DB_HOST, $DB_USER, $DB_PASS, $DB_NAME);
if($conn->connect_errno > 0) {
die('Connection failed [' . $conn->connect_error . ']');
}

$password = "rasmuslerdorf";
$first_name = "john";
$password = password_hash($password, PASSWORD_DEFAULT);

$sql = "INSERT INTO users (`name`, `password`) VALUES ('" .$first_name ."', '" .$password ."')";

    $query = mysqli_query($conn, $sql);
    if($query)

{
    echo "Success!";
}

else{
    // echo "Error";
    die('There was an error running the query [' . $conn->error . ']');
}

登录文件

<?php
// session_start();

$DB_HOST = 'xxx';
$DB_USER = 'xxx';
$DB_PASS = 'xxx';
$DB_NAME = 'xxx';

$conn = new mysqli($DB_HOST, $DB_USER, $DB_PASS, $DB_NAME);
if($conn->connect_errno > 0) {
  die('Connection failed [' . $conn->connect_error . ']');
}

$pwd = "rasmuslerdorf";
$first_name = "john";

//$sql = "SELECT * FROM users WHERE id = 1";

        $sql = "SELECT * FROM users WHERE name='$first_name'";
        $result = $conn->query($sql);
        if ($result->num_rows === 1) {
            $row = $result->fetch_array(MYSQLI_ASSOC);
            if (password_verify($pwd, $row['password'])) {

                //Password matches, so create the session
                // $_SESSION['user'] = $row['user_id'];
                // header("Location: http://www.example.com/logged_in.php");

                echo "Match";

            }else{
                echo  "The username or password do not match";
            }

}

 mysqli_close($conn);

脚注：

密码列应该足够长以容纳哈希。72 long是散列在字符长度中产生的结果，但手册建议为255。

参考资料：

• http://php.net/manual/en/function.password-hash.php

“使用bcrypt算法(缺省值为PHP 5.5.0)。请注意，随着新算法和更强的算法添加到PHP中，此常量将随着时间的推移而改变。因此，使用此标识符的结果长度可能随时间而变化。因此，建议将结果存储在一个可扩展到60个字符以上的数据库列中(255个字符将是一个不错的选择)。”

Answer 2

朋友们，因为我们在登录时使用的是唯一的用户名，所以我们只能使用用户名从数据库中获取密码/数据。

示例：

<?php
    $connect = mysqli_connect($localhost, $username, $pwd, $database) or die("Opps some thing went wrong");

    if (isset($_POST['submit'])) {
      extract($_POST);

     // Get Old Password from Database which is having unique userName
     $sqlQuery = mysqli_query($connect, "select * from loginTable where User='$username'");
     $res = mysqli_fetch_array($sqlQuery);
     $current_password = $res['userPassword'];

     if (password_verify($enteredPassword, $current_password)) { 
        /* If Password is valid!! */
        $_SESSION['id'] = $res['id'];
        header("location: home.php");
     }
     else { 
        /* If Invalid password Entered */
        $alt = "Login Failed! Wrong user ID or Password";
        header("location: index.php?m=$alt");
     }
  }
?>

它对我有用..。我从数据库中获取密码，并使用PHP ( password_verify($enteredPassword，$current_password) )与输入的密码进行比较。