php - Bcrypt 哈希检查不起作用

Question

我尝试过使用两种不同的包装器，即 password_compat和 Bcrypt , 来加密我的密码。哈希保存得很好，但检查比较永远不匹配。

我使用以下代码来存储散列密码:

//include ( "Bcrypt.php" );
include ( "password_compat-master/lib/password.php" );

if ( isset ( $_POST["username"] ) and isset ( $_POST["email"] ) and isset ( $_POST["password"] ) )
{

$username = $_POST["username"];
$password = $_POST["password"];
$email = $_POST["email"];

//$hash = Bcrypt::hash( $password );
$hash = password_hash( $password , PASSWORD_BCRYPT ); //password_compat function

$connect = mysqli_connect( "server" , "user", "pass" , "database" );

//Code to generate next database key ($next)

$sql_insert = "INSERT INTO `use_users` (`UserID`,`Username`,`Password`,`EmailAddress`) VALUES('$next','$username','$hash','$email');";
$res_insert = $connect -> query( $sql_insert );

}

然后我使用以下代码来验证密码(我知道可能存在 SQL 注入(inject)!):

//include ( "Bcrypt.php" );
include ( "password_compat-master/lib/password.php" );

if ( isset ( $_POST["username"] ) and isset ( $_POST["password"] ) )
{

$username = $_POST["username"];
$password = $_POST["password"];

$connect = mysqli_connect( "server" , "user", "pass" , "database" );

$sql_verify = "SELECT * FROM `use_users` WHERE `Username`='$username';";
$res_verify = $connect -> query( $sql_verify );

while ( $exe_verify = mysqli_fetch_array( $res_verify ) )
{

$hash = $exe_verify["Password"];

//$check = Bcrypt::check( $password , $hash );
$check = password_verify( $password , $hash ); //password_compat function

if ( $check ) echo "Pass.";
else if ( ! $check ) echo "Fail.";

}

}

当我编写自己的哈希检查 (crypt( $password, $hash)) 时，它会返回与存储的哈希相同的哈希，但会附加额外的字符。

我做错了什么？是 MySQL 的东西吗？

Answer 1

我认为您的字段可以存储比生成的哈希长度更少的字符。所以 hash 在 instert 之前被截断了。