php - 比较哈希字符串

Question

我用这个把我的头发拔掉了。我将散列加盐密码和相关的加盐存储在 MySQL 数据库中。它用于登录脚本。存储数据工作正常，数据以 CHAR(128) 类型存储在数据库上。

但是，当我无法将密码字符串与登录表单中的哈希登录密码成功匹配时。我已将所有内容简化为基本内容，但即使输出(echo 或 var_dump)看起来相同，它仍然不匹配。

这是注册代码片段:

$_POST['dk_username'] = mysql_real_escape_string($_POST['dk_username']);
$_POST['dk_password'] = mysql_real_escape_string($_POST['dk_password']);
$username = stripslashes($_POST['dk_username']);
$password = stripslashes($_POST['dk_password']);

$salt = uniqid(mt_rand());
$newhash= $salt . $password;
$hashPass= hash('sha512', $newhash);

$email=$_POST['email'];

$sql="INSERT INTO users (uName,uPass2,uEmail,uSalt,uID)
VALUES ('$username','$hashPass','$email', '$salt', 'time()')";

mysql_query($sql) or die('Error, insert query failed');

这是登录片段:

$_POST['dk_username'] = mysql_real_escape_string($_POST['dk_username']);
$_POST['dk_password'] = mysql_real_escape_string($_POST['dk_password']);
$username = stripslashes($_POST['dk_username']);
$password = stripslashes($_POST['dk_password']);


$query = "SELECT uID, uPass2, uSalt, uName FROM users WHERE uName = '$username';"; 
$result = mysql_query($query); 
if(mysql_num_rows($result) < 1) //no such user exists 
{     echo 'Wrong username and/or password!'; 
} 
$userData = mysql_fetch_array($result, MYSQL_ASSOC); 
$salt=$userData['uSalt'];
$newhash= $salt . $password;
$hashPass= hash('sha512', $newhash);
$tempData=strcmp($hashpass, $userData['uPass2']);
if(hashPass != $userData['uPass2']){
echo "password not correct:<br/>";
echo "db: " . var_dump($userData['uPass2']) . "<br />";
echo "in: " . var_dump($hashPass) . "<br />; 
echo $tempData . "<BR />";

}else{
echo "logged in";
}

登录结果:

password not correct:
string(128) "98f713244f3d97e8629222f8d37e3cad38c5c1e2fbf011c135723f36b7841ef29785b1866ac6dbab9cd044b12db8e4d16a4c68df1e3d7b8f4a27a8c3d4c9bca5" db: 
string(128) "98f713244f3d97e8629222f8d37e3cad38c5c1e2fbf011c135723f36b7841ef29785b1866ac6dbab9cd044b12db8e4d16a4c68df1e3d7b8f4a27a8c3d4c9bca5" in: 
-128

Answer 1

$hashPass 此处缺少您的$:

if(hashPass != $userData['uPass2']){

目前，它导致 PHP 将 $userData['uPass2'] 与名为 hashPass 的常量进行比较(PHP 将其视为字符串 'hashPass' 如果未定义常量)。

将 error_reporting 设置为包含 E_NOTICE 会导致 PHP 发出有关“常量”的通知。