PHP登录系统密码不匹配

Question

我制作了一个登录系统，允许用户使用先前定义的电子邮件和密码登录，但是在测试部分，我注意到密码说它们不匹配，尽管我知道它们是正确的，正如我所写的当我做的时候，测试就下来了。我似乎不明白为什么会发生这种情况，我认为这可能与我对密码的散列有关，但我不知道是什么。登录页面检查来自文档，login.php:

    if(empty($errors))
{
    $sql = "SELECT accountID, password FROM users WHERE emails=?";
    $stmt = $pdo->prepare($sql);
    $stmt->execute([$data['email']]);

    if(!$row = $stmt->fetch())
    {
        // email didn't match
        $errors['login'] = "Login failed. on email";
    }
    else
    {
        // email matched, test password
        if(!password_verify($data['password'],$row['password']))
        {
            // password didn't match
            $errors['login'] = "Login failed. on password";
        }
        else
        {
            // password matched
            $_SESSION['user_id'] = $row['accountID'];
            header('location: welcome.php');
            die;
        }
    }
}

使用哈希值插入数据库是来自 insert.php:

    if (isset($_POST['name'])){
        $name = $_POST['name'];
    }
    if (isset($_POST['email'])){
        $email = $_POST['email'];
    }
    if (isset($_POST['password'])){
        $pword = $_POST['password'];
    }
    if (isset($_POST['busName'])){
        $busName = $_POST['busName'];
    }

    if (empty($name)){
        echo("Name is a required field");
        exit();
    }
    if (empty($email)){
        echo ("email is a required field");
        exit();
    }
    if (empty($pword)){
        echo("You must enter a password");
        exit();
    }
    $pword = password_hash($pword, PASSWORD_DEFAULT)."/n";



//insert html form into database
$insertquery= "INSERT INTO  `cscw`.`users` (
`accountID` ,
`businessName` ,
`name` ,
`emails` ,
`password`
)
VALUES (
NULL ,  '$busName',  '$name',  '$email',  '$pword'
);";

在网页上，我从login.php中显示“登录失败。密码”。如果您需要查看更多代码，请告诉我。

Answer 1

它无法识别$row['password']。始终组织好您的查询 **
1)准备
2)执行
3)获取
4)关闭
5)然后你利用获取的数据。获取的数据需要按 returnArray 函数所示进行排序。

希望有唯一的电子邮件并且 $data 数组存在。试试这个。

if(empty($errors))
{

    $sql = "SELECT accountID, password FROM users WHERE emails=:emails";
    $stmt = $pdo->prepare($sql);
    $stmt->bindParam(':emails', $data['email']);
    $stmt->execute();
    $rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
    $stmt->CloseCursor();
    $stmt=null;

    /* Return the results is a more handy way */
    function returnArray( $rows, $string )
    {
       foreach( $rows as $row )
       {
           return $row[ $string ];
       }
    }

   if( empty($rows) )
   {    // email didn't match
       $errors['login'] = "Login failed. on email";
   }
   else
   {      // email matched, test password
       if( !password_verify( $data['password'], returnArray($rows,'password') ) )
       {
          // password didn't match
          $errors['login'] = "Login failed. on password";
       }
       else
       {
          // password matched
          $_SESSION['user_id'] = $row['accountID'];
          header('location: welcome.php');
          die;
       }
   }
}

<小时/>

登录页面未完成，查询未插入。小心你可能容易受到 SQL 注入(inject)的攻击，因为你没有转义用户操纵的变量。(为了加强安全性，添加一个表单验证，这会很棒)。

您已使用$pword = password_hash($pword, PASSWORD_DEFAULT)."/n";我删除了 ."/n"部分。我似乎您正在使用串联运算符“.”添加/n 添加password_hash 的末尾。

您的 $insertquery 尚未完成且不可读。您不需要在查询中插入反引号。并且无需选择 accountID，它会自动递增(查看数据库中是否勾选了 accountID 的 A_I)。在您的登录页面中执行类似的操作。

/* trim and escape*/
function escapeHtmlTrimed( $data )
{
    $trimed = trim( $data );
    $htmlentities = htmlentities( $trimed, ENT_QUOTES | ENT_HTML5, $encoding = 'UTF-8' );
    return $htmlentities;
}


if ( isset( $_POST['name'] ) ){
    $name = escapeHtmlTrimed( $_POST['name'] );
}
if ( isset($_POST['email']) ){
    $email = escapeHtmlTrimed( $_POST['email'] );
}
if ( isset($_POST['password']) ){
    $pword = escapeHtmlTrimed( $_POST['password'] );
}
if ( isset($_POST['busName']) ){
    $busName = escapeHtmlTrimed( $_POST['busName'] );
}

if ( empty($name) ){
    echo("Name is a required field");
    exit();
}
if ( empty($email) ){
    echo ("email is a required field");
    exit();
}
if ( empty($pword) ){
    echo("You must enter a password");
    exit();
}
/*Remove this your adding "./n"*/
$pword = password_hash($pword, PASSWORD_DEFAULT);



//insert html form into database
$insertquery= "INSERT INTO users (businessName ,name ,emails, 
password) VALUES (:busName , :name, :email , :pword)";
$stmt = $pdo->prepare($insertquery);
$stmt->bindParam(':busName', $busName);
$stmt->bindParam(':name', $name);
$stmt->bindParam(':email', $email);
$stmt->bindParam(':pword', $pword);
$stmt->execute();
$stmt->CloseCursor();
$stmt=null;