php - 散列密码和登录名

Question

我在创建新用户时试图散列密码。这是添加用户时我所拥有的:

$username = $_POST['username'];
$password = $_POST['password'];

$options = [
'cost' => 11,
'salt' => hash('sha256', uniqid(mt_rand(), true) . 'dsdsajJDSK&&^*^%FKLD876' . strtolower($username)),
];
$hash = password_hash($password, PASSWORD_BCRYPT, $options);
$sql = "INSERT INTO users ( username, password)
           VALUES (:username, :password)";

$q = $pdo->prepare($sql);
$q->execute(array(
         ':username' => $username,
        ':password' => $hash                                
        ));        

在数据库中存储的是这样的

$2y$11$fbd730bf81fe115d43283uAjC849wT.rD1F7CuBHEJHCVIVNn The in my login file I have this

<?php
session_start();
include 'misc/database.inc.php';
if(isSet($_POST['submit'])) 
{
     $pdo = Database::connect();
     $username=$_POST['username']; 
     $password=$_POST['password']; 

     $stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username LIMIT 1");

     $stmt->bindParam(':username', $username);
     $stmt->execute();
     $res  = $stmt -> fetch();
     if(password_verify($_POST['password'], $res["password"]))
     {

         if ($res['level'] == 1)
         {
             $_SESSION['username'] = $username;
             header( "location: admin/main.php");   
         }
         elseif ( $res['level'] >= 4 ) 
         {
             $_SESSION['user_id']   = $res['user_id'];
             $_SESSION['username'] = $username;
             header('Location: users/main.php');
         }
         else 
         {
             header("location: index.php");              
         }
         $pdo = null;
     }
} else {
?>
 // html
<?php } ?>

问题是我的用户有旧的 sha1 密码，我可以用这个用户登录。我想它一定不能登录？

更新:

$username=$_POST['username']; 
$password=$_POST['password']; 

$stmt = $pdo->prepare("SELECT username,password FROM users WHERE username = :username LIMIT 1");
$stmt->bindParam(':username', $username);

$stmt->execute();
$res  = $stmt -> fetch();
if(password_verify($password, $res["password"])){
//if(password_verify($_POST['password'], $res["password"])){
    ...
} else {
    ...
} 

Answer 1

全部password_verify()需要的是用户的密码和来自数据库的散列。您不需要自己再次对任何内容进行哈希处理。

相反，您应该只使用:

if(password_verify($password, $res["password"])){
// or
if(password_verify($_POST['password'], $res["password"])){