gpt4 book ai didi

php - 如何从数据库和 auth 用户中收回加盐密码?

转载 作者:行者123 更新时间:2023-11-29 06:10:53 24 4
gpt4 key购买 nike

这是我第一次尝试使用所有存储在数据库 (MySQL) 中的加盐密码来实现成员(member)网站。除了“成员(member)登录”页面中的错误外,一切正常。

错误:成员(member)登录页面接受成员(member)网站的任何条目,并且出于某种原因通过了我对 $result === false

的检查

这是检查成员是否存在的代码,请告诉我问题是什么:

$servername = 'localhost';
$username = 'root';
$pwd = '';
$dbname = 'lp001';

$connect = new mysqli($servername,$username,$pwd,$dbname);

if ($connect->connect_error){
die('connection failed, reason: '.$connect->connect_error);
}


$name = mysqli_real_escape_string($connect, $_POST['name']);
$password = mysqli_real_escape_string($connect, $_POST['password']);
$saltQuery = "SELECT salt FROM users WHERE name = '$name';";
$result = mysqli_query($connect, $saltQuery);
if ($result === false){
die(mysqli_error());
}
$row = mysqli_fetch_assoc($result);
$salt = $row['salt'];

$saltedPW = $password.$salt;
$hashedPW = hash('sha256', $saltedPW);
$sqlQuery = "SELECT * FROM users WHERE name = '$name' AND password = '$hashedPW'";

if (mysqli_query($connect, $sqlQuery)){
echo '<h1>Welcome to the member site '.$name.'</h1>';
}else{
echo 'error adding the query: '.$sql_q.'<br> Reason: '.mysqli_error($connect);
}

最佳答案

开发人员常常为验证登录密码而苦恼,因为他们不确定如何处理存储的密码哈希。他们知道应该使用适当的函数对密码进行哈希处理,例如 password_hash() ,并将它们存储在 varchar(255) 字段中:

// Hash a new password for storing in the database.
// The function automatically generates a cryptographically safe salt.
$hashToStoreInDb = password_hash($password, PASSWORD_DEFAULT);

在登录表单中,我们不能直接用SQL验证密码,也不能搜索密码,因为存储的散列是加盐的。相反,我们...

  1. 必须从数据库中读取密码散列,通过用户 id 搜索
  2. 然后可以使用 password_verify() 根据找到的哈希检查登录密码功能。

您可以在下面找到一些示例代码,展示如何使用 mysqli 连接进行密码验证。该代码没有错误检查以使其可读:

/**
* mysqli example for a login with a stored password-hash
*/
$mysqli = new mysqli($dbHost, $dbUser, $dbPassword, $dbName);
$mysqli->set_charset('utf8');

// Find the stored password hash in the db, searching by username
$sql = 'SELECT password FROM users WHERE username = ?';
$stmt = $mysqli->prepare($sql);
$stmt->bind_param('s', $_POST['username']); // it is safe to pass the user input unescaped
$stmt->execute();

// If this user exists, fetch the password-hash and check it
$isPasswordCorrect = false;
$stmt->bind_result($hashFromDb);
if ($stmt->fetch() === true)
{
// Check whether the entered password matches the stored hash.
// The salt and the cost factor will be extracted from $hashFromDb.
$isPasswordCorrect = password_verify($_POST['password'], $hashFromDb);
}

请注意,该示例使用准备好的语句来避免 SQL 注入(inject),在这种情况下不需要转义。从 pdo 连接读取的等效示例如下所示:

/**
* pdo example for a login with a stored password-hash
*/
$dsn = "mysql:host=$dbHost;dbname=$dbName;charset=utf8";
$pdo = new PDO($dsn, $dbUser, $dbPassword);

// Find the stored password hash in the db, searching by username
$sql = 'SELECT password FROM users WHERE username = ?';
$stmt = $pdo->prepare($sql);
$stmt->bindValue(1, $_POST['username'], PDO::PARAM_STR); // it is safe to pass the user input unescaped
$stmt->execute();

// If this user exists, fetch the password hash and check it
$isPasswordCorrect = false;
if (($row = $stmt->fetch(PDO::FETCH_ASSOC)) !== false)
{
$hashFromDb = $row['password'];

// Check whether the entered password matches the stored hash.
// The salt and the cost factor will be extracted from $hashFromDb.
$isPasswordCorrect = password_verify($_POST['password'], $hashFromDb);
}

关于php - 如何从数据库和 auth 用户中收回加盐密码?,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/38300242/

24 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com