php - 登录表单不读取 sha512

Question

我将 sha512 添加到此登录表单，但我一直收到错误用户名或密码无效。我用了http://www.convertstring.com/Hash/SHA512在数据库中设置密码

为什么不起作用？数据库中的密码是用 sha512 + salt 散列的，但我一直收到用户名/密码不正确的错误。

if(isset($_POST['submit'])) {
    $password1 = ($_POST['password_']);
    $salted = "b5vy2m92m9c5my925myic52ddqwm534itkic4m3timcy35".$password1;
    $hashed = hash('sha512', $salted);

    if(!$_POST['username_'] || !$hashed) {

        echo '<div class="alert alert-block alert-danger"><button type="button" class="close" data-dismiss="alert"><i class="ace-icon fa fa-times"></i></button>Complete all fields.</div>';    
    } else {    
        $q = Config::$g_con->prepare('SELECT * FROM `users` WHERE `name` = ? AND `password` = ?');    
        $q->execute(array($_POST['username_'], $hashed));

登录表单

<input type="text" name="username_"/><br/>
<input type="password" name="password_"/><br/>
<input type="submit" name="submit" value="login" class="btn btn-inverse">

总脚本:

if(isset($_SESSION['user'])) echo '<script> 
    location.replace("'.Config::$_PAGE_URL.'"); </script>'
if(isset($_POST['submit'])) {
$password1 = ($_POST['password_']);
$salted = "b5vy2m92m9c5my925myic52ddqwm534itkic4m3timcy35".$password1;
$hashed = hash('sha512', $salted);    
if(!$_POST['username_'] || !$hashed) {    
        echo '<div class="alert alert-block alert-danger"><button type="button" class="close" data-dismiss="alert"><i class="ace-icon fa fa-times"></i></button>Complete all fields.</div>';    
    } else {    
        $q = Config::$g_con->prepare('SELECT * FROM `users` WHERE `name` = ? AND `password` = ?');
        $q->execute(array($_POST['username_'], $hashed));    
        if($q->rowCount()) {
            $d = Config::$g_con->prepare('SELECT * FROM `panel_restrict` WHERE `PlayerName` = ?');    
            $d->execute(array($_POST['username_']));    
            $row1 = $d->fetch(PDO::FETCH_OBJ);    
            if($d->rowCount() && date("Y-m-d H:i:s") <= gmdate("Y-m-d H:i:s", $row1->Time)) { 
                if($row1->Permanent == 1)   {    
                    $expira = "<b>permanent</b>";    
                } else {    
                    $expira = "pana la data de <b>". gmdate("Y-m-d H:i:s", $row1->Time) ."</b>";    
                }    
                echo '<div class="alert alert-block alert-danger">    
                Contul tau este suspendat '.$expira.'.<br />    
                Motiv: <b>'.$row1->Reason.'</b><br />    
                Banat pe data de <b>'.$row1->BanTimeDate.'</b></div>';    
            } else {                        
                $dele = Config::$g_con->prepare("DELETE FROM panel_restrict WHERE PlayerName = ?");    
                $dele->execute(array($_POST['username_']));    
                $row = $q->fetch(PDO::FETCH_OBJ);    
                $_SESSION['user'] = $row->id;
                echo '<script> location.replace("'.Config::$_PAGE_URL.'"); </script>';    
                //setcookie ("user",$_POST['username_'],time()+3600*24*60);    
                //setcookie ("password",$_POST['password_'],time()+3600*24*60);    
                //header ('Location: ' . $_PAGE_URL);
            }
        }
        else echo '<div class="alert alert-block alert-danger"><button type="button" class="close" data-dismiss="alert"><i class="ace-icon fa fa-times"></i></button>Invalid username or password.</div>';    
    }    
}

Answer 1

stop telling to use something better... even if i would you bcrypt you would say use something better, help me fix this problem please..

没有。人们告诉您使用 password_hash() 和 password_verify() 是有充分理由的。使用它们。它将为您节省大量工作，更重要的是，它有望阻止您自己实现半生不熟的解决方案。您应该不创建自己的盐。事实上，从 PHP 7 开始，它已被弃用。

现在，回答你的问题。当您使用在线工具生成哈希时，您输入了一个盐。此在线工具预先您的密码加盐。 您正在将其附加到您的密码中。除此之外，我认为来自在线工具的大小写是大写您的散列，而PHP 将其保留为小写。您需要比较相同的情况。

http://sandbox.onlinephpfunctions.com/code/b3801209519783618445a06d31380b24b876fd4c

综上所述，是的，使用 password_hash() 和 password_verify() 让您的生活更轻松。 http://php.net/manual/en/function.password-hash.php