php - 使用 SHA512 进行哈希处理，但仍然无法读取密码。登录后仍然无效，为什么？

Question

如何正确读取哈希密码？因为当我尝试登录时，它仍然显示密码无效。我不知道出了什么问题。我很难修复这个问题。

这是我的login.php

$con = mysql_connect("localhost","root","");
$db = @mysql_select_db("buybranded");
// Select the database to use
mysql_select_db("buybranded",$con);
if(! $con)
{
    die('Connection Failed'.mysql_error());
}

$user=$_POST["email"];
$pass=$_POST["password"];

$user = stripslashes($user);
$pass = stripslashes($pass);
$user = mysql_real_escape_string($user);
$pass = mysql_real_escape_string($pass);



$hashed = hash('sha512', $pass);
$result = mysql_query("SELECT * FROM users WHERE email = $user AND password= $hashed");

if (!$row = mysql_fetch_array($result))
{
die(mysql_error());
}

if($row["username"]==$user && $row["password"]==$pass)
    echo"You are a validated user.";
else
    echo"Sorry, your credentials are not valid, Please try again.";
?>

这是我的 checklogin.php

<?php


$host="localhost"; // Host name 
$username="root"; // Mysql username 
$password=""; // Mysql password 
$db_name="buybranded"; // Database name 
$tbl_name="users"; // Table name 

// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB");

// Define $myusername and $mypassword 

$email=$_POST['email']; 
$password=$_POST['password']; 
$query=mysql_query("SELECT * FROM users where email = '$email'");
session_start();

    while($row = mysql_fetch_array($query)){
    $_SESSION["email"] = $row['email'];
    $_SESSION["password"] = $row['password'];
    $_SESSION["first_name"] = $row['first_name'];
    echo $_SESSION['first_name'];
    $_SESSION["middle_name"] = $row['middle_name'];
    $_SESSION["last_name"] = $row['last_name'];
    $_SESSION["gender"] = $row['gender'];
    $_SESSION["birth_date"] = $row['birth_date'];
    $_SESSION["home_address"] = $row['home_address'];
    $_SESSION["mobile_phone"] = $row['mobile_phone'];
    $_SESSION["home_phone"] = $row['home_phone'];
    $_SESSION["postal_code"] = $row['postal_code'];
    $_SESSION["city"] = $row['city'];
    $_SESSION["province"] = $row['province'];
}
// To protect MySQL injection (more detail about MySQL injection)
$email = stripslashes($email);
$password = stripslashes($password);
$email = mysql_real_escape_string($email);
$password = mysql_real_escape_string($password);
$sql="SELECT * FROM $tbl_name WHERE email='$email' and password='$password'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);

// If result matched $myusername and $mypassword, table row must be 1 row
if($count==1){

// Register $myusername, $mypassword and redirect to file "login_success.php"


    while($row = mysql_fetch_array($result)){
        //remove this line ******header("location:customer_home.php");
        if($row['type'] == 'admin'){
            $_SESSION['isAdmin'] = true;
            header("location: admin.php");
        } else if($row['type'] == 'customer'){
            header("location: customer_home.php");
        }
    }
}

else {

header('refresh: 0.1; url=sign-in.php');
$message = "Invalid Email or Password, Redirecting..";
die("<script type='text/javascript'>alert('$message');</script>"); // To prevent evil people manipulating the page, kill the script using die.

}

?>

Answer 1

由于您使用的是 SHA512，您是否检查过表的数据类型是否为 CHAR 128？正如亚历山大所说。将其放入 checklogin.php