php - password_verify() 函数返回空变量

Question

我使用 PHP 和 mySQLi 编写了简单的登录脚本。问题是 password_verify() 函数返回空变量。我已经仔细检查了所有内容，但我没有看到它。哪里有问题 ？

session_start();

if (isset($_POST["submit"])) {

    include_once("dbh.inc.php");

    // Get data from POST request
    $uid = mysqli_real_escape_string($conn, $_POST["uid"]);
    $passwd = mysqli_real_escape_string($conn, $_POST["passwd"]);

    // Check if fields are empty
    if (empty($uid) || empty($passwd)) {
        echo "One or more of inputs was left blank";
        exit();
    } else { 
        $result = mysqli_query($conn, "SELECT * FROM users WHERE uid='$uid' OR email='$uid';");
        if (mysqli_num_rows($result) < 1) {

            // Forward to login page with GET failed=notFound
            header("Location: ../login.php?failed=notFound");
            exit();
        } else {
            if ($row = mysqli_fetch_assoc($result)) {
                $pwdCheck = password_verify($passwd, $row["pwd"]);
                if (!$pwdCheck) {
                    header("Location: ../login.php?failed=pwd");
                    exit();
                } elseif ($pwdCheck) {

                    // Login here
                    $_SESSION["id"] = $row["id"];

                    // Forward to login page with GET failed=0
                    header("Location: ../login.php?failed=0");
                    exit();
                }
            }
        }
    }
} else {
    header("Location: ../login.php");
    exit();
}

Answer 1

1)确保您获取正确的详细信息

2) 确保在插入数据库时​​使用 (password_hash($passwd, PASSWORD_DEFAULT)) 正确对密码进行哈希处理

3)还要确保密码列具有令人满意的长度，能够接受整个散列密码长度

4) 并且避免使用 mysql_escape_string($_post['passwd']) 某些服务器不接受它，或者尝试使用 htmlspecialchars_decode(trim($_post['passwd']));