PHP/MYSQL 使用盐密码验证用户登录？

Question

我对 MySQL 和 PHP 很陌生，所以很抱歉，但我在尝试让我的代码正常工作时遇到了问题。用户可以使用用户名和密码在我的网站上注册。我知道应该使用称为盐的加密方法来存储密码。因此，现在完成此操作后，我希望用户能够登录，但我不确定我做得是否正确。

此时我收到一个错误:

Fatal error: Call to undefined function db() in C:\xampp\htdocs\hewden\ssa\suppliers\include\validate_login.php on line 16

这是我的注册码:

<?php 
    session_start();
    include("../include/config.php");
    //retrieve our data from POST
    $contactname = $_POST['contactname'];
    $compname = $_POST['compname'];
    $username = $_POST['emailaddress'];
    $password1 = $_POST['password1'];
    $password2 = $_POST['password2'];

    if($password1 != $password2) {
    $_SESSION['message2'] = '<div id="message_box2"><div class="boxclose" id="boxclose" onclick="this.parentNode.parentNode.removeChild(this.parentNode);"></div><h23>Ooops!</h23><p>The Password&#39;s did not match.</p> </div>';
    header("location:..\sign-up.php");

    }else{
    if(strlen($username) > 30) {
    $_SESSION['message2'] = '<div id="message_box2"><div class="boxclose" id="boxclose" onclick="this.parentNode.parentNode.removeChild(this.parentNode);"></div><h23>Ooops!</h23><p>The Username you have selected is incorrect.</p> </div>';
    header("location:..\sign-up.php");

    }else{

    $hash = hash('sha256', $password1);

    function createSalt(){
    $text = md5(uniqid(rand(), true));
    return substr($text, 0, 3); }
    $salt = createSalt();
    $password = hash('sha256', $salt . $hash);

    $username = mysql_real_escape_string($username);
    $query = "INSERT INTO supplier_pre_sign (contact_name, company_name, supplier_email, password, salt, date) VALUES ('$contactname','$compname','$username', '$password', '$salt', now())";
    mysql_query($query); //You forgot to add this line
    echo $salt;

    } }?>

这会存储在我的表“supplier_pre_sign”中，如下所示:

ID (AI)   |   contact_name   |     company_name   |   supplier_email    |    password     |    salt

1               Dave                Hewden            hewden@hewden.com     test(hashed)        431

注册获得批准后，它们将被复制到我的另一个表“supplier_users”

这个表是这样的:

ID   |   USERNAME             |   PASSWORD       |   SALT  |  ONLINE
1        hewden@hewden.com        test(hashed)       431      Offline

这是我的登录代码:

<?php
session_start();
include("config.php");
$tbl_name="internal_users";  
$tbl_name2="supplier_users";  
$myusername=$_POST['myusername']; 
$mypassword=$_POST['mypassword']; 
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);
$sql = "select * from $tbl_name where username = '$myusername' and password = '$mypassword',
union
select * from $tbl_name2 where username = '$myusername' and password = '$mypassword'";

$sql = db("select * from $tbl_name where username = '$myusername' and password = '$mypassword',
    union
select * from $tbl_name2 where username = '$myusername' and password = '$mypassword'",
    $_POST['myusername'], hmac_hash("sha256", $_POST['mypassword'], $salt));
if(numRows($res) > 0) {


$result=mysql_query($sql);
$count=mysql_num_rows($result);
$row=mysql_fetch_array($result);
if($count==1){
session_start();
$_SESSION['user']=$myusername;
$_SESSION['username']=$row['First_Name'];
if(isset($_SESSION['val']))
$_SESSION['val']=$_SESSION['val']+1;
if($result){
$sql2 = "UPDATE $tbl_name2 SET online = 'online' WHERE online = 'offline'";  
$result2=mysql_query($sql2); }
else
$_SESSION['val']=1;
header("location:../dashboard.php");
}
else {
    echo mysql_error();
$_SESSION['message2'] = '<div id="message_box2"><div class="boxclose" id="boxclose" onclick="this.parentNode.parentNode.removeChild(this.parentNode);"></div><h23>Oooops!</h23><p>The Username and Password Combination do not match. Please try again.</p> </div>';
header("location:../index.php");
} }
ob_end_flush();
?>

现在我的问题是如何让我的登录脚本来验证用户身份，因为我不太了解盐是如何工作的，我的用户只需输入“test”期望它登录，那么我该如何通过检查盐密码匹配来登录它们？

提前致谢

Answer 1

PHP 现在有一个内置函数 password_hash()以此目的。该函数生成长度为 60 个字符的 BCrypt 哈希(包括盐)，因此您不必单独存储盐。

// Hash a new password for storing in the database.
// The function automatically generates a cryptographically safe salt.
$hashToStoreInDb = password_hash($password, PASSWORD_BCRYPT);

// Check if the hash of the entered login password, matches the stored hash.
// The salt and the cost factor will be extracted from $existingHashFromDb.
$isPasswordCorrect = password_verify($password, $existingHashFromDb);

附注不要使用 SHA-* 或 MD5 等任何哈希算法，因为它们没有成本因素并且速度太快。欲了解更多信息，您可以查看我的tutorial关于安全存储密码。