个人中心
gpt4 book ai didi

php - 如何正确使用password_verify()？

转载 作者：行者123 更新时间：2023-11-29 17:37:10 26 4
gpt4 key购买 nike

我正在尝试制作一个登录/注册系统（在与索引相同的页面上，使用z-index），并且注册if（function）可以正常工作，因为我可以看到哈希密码完美地存储在数据库中，但是我没有在password_verify字段中看不到我要去哪里。另外，为了我的用户的安全起见，$ db变量中标有登录名和本地主机端口信息。

if (session_status() == PHP_SESSION_NONE) {
    session_start();
}
$db = mysqli_connect('localhost:****', '********_******M', 'W***********', '****logins');
if(isset($_POST['log'])) {
    $username = mysqli_real_escape_string($db, $_POST['usr']);
    $password = mysqli_real_escape_string($db, $_POST['pass']);
    $errors = array();

    if (empty($username)) {
         array_push($errors, "Username is required");
    }
    if (empty($password)) {
         array_push($errors, "Password is required");
    }

    if (count($errors) == 0) {
        $user_check_query = "SELECT * FROM users WHERE username='$username'";
        $result = mysqli_query($db, $user_check_query);
        $user = mysqli_fetch_assoc($result);

  if ($user) { // if user exists
    if (password_verify($password, $user['password'])) {
        $login = true;
        $_SESSION['username'] = $username;
    } else {
        $login = false;
    }
}
    if (mysqli_num_rows($results) == 1) {
        $_SESSION['username'] = $username;
        $login = true;
    }else {
        array_push($errors, "Wrong username/password combination");
        $login = false;
    }
}
//MySQL compare info
} else if(isset($_POST['signup'])) {
    $username = "";
    $email    = "";
    $errors = array(); 

    // connect to the database
    // REGISTER USER
    // receive all input values from the form
    $username = mysqli_real_escape_string($db, $_POST['username']);
    $email = mysqli_real_escape_string($db, $_POST['email']);
    $password_1 = mysqli_real_escape_string($db, $_POST['password']);
    $password_2 = mysqli_real_escape_string($db, $_POST['confirmpass']);
    $bio = mysqli_real_escape_string($db, $_POST['bio']);
    // form validation: ensure that the form is correctly filled ...
    // by adding (array_push()) corresponding error unto $errors array
    if (empty($username)) { array_push($errors, "Username is required"); }
    if (empty($email)) { array_push($errors, "Email is required"); }
    if (empty($password_1)) { array_push($errors, "Password is required"); }
    if ($password_1 != $password_2) {
        array_push($errors, "The two passwords do not match");
    }

  // first check the database to make sure 
  // a user does not already exist with the same username and/or email
  $user_check_query = "SELECT * FROM users WHERE username='$username' OR email='$email' LIMIT 1";
  $result = mysqli_query($db, $user_check_query);
  $user = mysqli_fetch_assoc($result);

  if ($user) { // if user exists
        if ($user['username'] === $username) {
       array_push($errors, "Username already exists");
  }

  if ($user['email'] === $email) {
     array_push($errors, "email already exists");
  }
  $login = false;
}

// Finally, register user if there are no errors in the form
if (count($errors) == 0) {
    $password = password_hash($password_1, PASSWORD_DEFAULT);//encrypt the password before saving in the database

    $query = "INSERT INTO users (username, email, password, bio) 
          VALUES('$username', '$email', '$password', '$bio')";
    mysqli_query($db, $query);
    $_SESSION['username'] = $username;
    $_SESSION['bio'] = $bio;
} else if(isset($_SESSION['active'])) {
    $username = $_SESSION['username'];
} else {
    $username = "Guest";
}
if($login === false) {
    $username = "Guest";
}


编辑：我的html如下。 

<html>
<head>
    <link href="global.css" rel="stylesheet" />
    <title>Matrix-Hub</title>
</head>
<body>
    <!-- Soon to be login/signup page goes here -->
    <div id="login">
        <form class="login" method="post" action="" name="login" id='log'>
            <p>Username:</p>
            <input type="text" name="usr" placeholder="username" />
            <p>Password:</p>
            <input type="password" name="pass" placeholder="password" />
            <br>
            <input type="submit" name="log" value="Log In" />
            <button type="button" onclick="switchtoSign()">Sign Up</button>
        </form>
        <form class="login" style='display:none;' method="post" action="" name="sign" id="signup">
            <p>Username:</p>
            <input type="text" name="username" placeholder="username" />
            <p>Password:</p>
            <input type="password" name="password" placeholder="Password" />
            <p>Confirm Password:</p>
            <input type="password" name="confirmpass" placeholder="Confirm" />
            <p>Email:</p>
            <input type="text" name="email" placeholder="Email..." />
            <p>Bio:</p>
            <textarea name="bio" placeholder="optional"></textarea>
            <input type="submit" name="signup" value="Sign Up" />
        </form>
    </div>
    <!-- Header -->
    <header class="main">
        <h1>Matrix-Hub: Home</h1>
        <nav>
            <center>
                <ul>
                    <li><a class="active" href="index.php">Home</a></li>
                    <li><a href="stylesheets.php">Stylesheets</a></li>
                </ul>
            </center>
        </nav>
    </header>
    <!-- Body - document - About - Other -->
    <div class="net">
        <center>
            <div class="document">
                <h1>About Matrix-Hub</h1>
                <h2>Stylesheets and More!</h2>
                <p>Matrix-Hub is a website, made by InsaneMatrix, for you to download
        , and soon post your own stylesheets. Currently sign-up and login systems
        are under development</p>
            </div>
            <div class="menu">
                <button class="item" onclick="document.getElementById('login').style.display='block'" type="button">
                Login / Signup
                </button>
                <a class="item" href="profile.php?username=<?php echo $username ?>">Profile: <?php echo $username; ?></a>
                <a class="item" href="styles/vintage/Vintage.html">Vintage - Style Sheet</a>
            </div>
        </center>
    </div>
    <div class="users">
        <h2>There are other people who love web design! You can check out their profiles too!</h2>
    </div>
    <script>
        function switchtoSign() {
            document.getElementById('log').style.display='none';
            document.getElementById('signup').style.display='block';
        }
    </script>
</body>
</html>

最佳答案

（这应该是评论，但有点长）

快速浏览一下代码，您似乎可以在成功登录后应用注册过程-但是，我不能真的那么费劲地仔细检查所有代码。您无需编写代码来让计算机理解，而是编写代码以供人们理解-这需要分解为离散的操作（作为函数或方法）。

以if (mysqli_num_rows($results) == 1) {开头的块似乎允许任何人进行身份验证，以提供带有无效密码的有效电子邮件，从而覆盖password_verify操作的结果。

创建用户时，使用mysqli_real_escape_string对其进行了转义后，便将password_hash函数应用于密码。如果您在验证密码时遇到相同的错误，这似乎可以正常工作-但仍然是错误的。在散列之后应用转义符。

将代码分成不同的关注点：

 $login=false;
 $errors=array();
 if ($_POST['log']) {
    check_username_and_password($username, $password, $errors);
 } else if ($_POST['signup']) {
    create_account($username, $pass1, $pass2, $errors);
 }
 if (count($errors)) {
    display_errors($errors);
    exit;
 } else {
    $_SESSION['username'] = $username;
    $login = true;  
 }

 function check_username_and_password($username, $password, &$errors)
 {
 ...


当问一个问题时，请描述您当前的实现方式如何/无法满足您的期望。

关于php - 如何正确使用password_verify()？，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/50200178/

26 4 0
文章推荐： android - 操作栏按钮仅显示在溢出中
文章推荐： javascript - 从 Angular 中的 @Input 更新 ngOnChanges View
文章推荐： Android AppCompat 工具栏不响应触摸操作项
文章推荐： javascript - 报错: webpack. optimize.CommonsChunkPlugin已被移除，请改用config.optimization.splitChunks
行者123
个人简介

我是一名优秀的程序员,十分优秀！

滴滴打车优惠券免费领取
滴滴打车优惠券
全站热门文章
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com