password_verify() 一直在登录

Question

使用 codeigniter 使用 BCRYPT 对我的密码进行哈希处理，似乎每次我登录时都会重定向到成功页面。所以我认为密码验证不起作用，即使我输入了错误的登录名，它仍然会重定向，也不会抛出 form_validation 错误。

我使用文档以及 SO 上的指南来设置它。最终会去 Ion Auth，但想知道如何解决这个问题。因为我还在学习code igniter mvc.

型号

class user_model extends CI_Model{

public function register($encrypt_pass){

$data = array(

'name'=> $this->input->post('name'),
'email'=> $this->input->post('email'),
'username'=> $this->input->post('username'),
'password'=>password_hash($encrypt_pass,PASSWORD_BCRYPT)

);

return $this->db->insert('customers',$data);

}

public function login($username,$password){

//validate the inputs from form
$this->db->where('username',$username);

$query = $this->db->get('customers'); //customers is the table

$result = $query->row_array();

if(!empty($result) && password_verify($password, $result['password'])){


  return $result;

}

else{

return "false";
}

}

}

控制器

public function login()
  {

 $this->form_validation->set_rules('username','Username','required');
$this->form_validation->set_rules('password','Password','required');

if($this->form_validation->run()=== FALSE){
$this->load->view('templates/header');
$this->load->view('users/login',$data);
$this->load->view('templates/footer');
}
else {

//Getting username
$username = $this->input->post('Username');

 //Getting and ecrypting password

$password = $this->input->post('Password');//password hashed

$user_id = $this->user_model->login($result);



//checking for user/pass correct will set session if so
 if($user_id){

$this->session->set_flashdata('user_loggedin','You are now logged in');
redirect('posts');
 }

// If combo is incorrect will redirect
else{

$this->session->set_flashdata('user_loggedin','Login Failed, Please Try 
Again');
redirect('users/login');

}

}

}

}

Answer 1

您在哪里检查密码是否匹配。在您的 controller.after 用户检查中试试这个。

if($user>0){
  if (password_verify($this->input->post('Password'), $user_id['password'])) {
//success message
}
else{
//error message.password is invalid
}

Answer 2

这是一个简单的工作登录代码，有很多方法可以做到，这只是一个例子。

在您的模型上

创建一个将 check/get 用户名密码的函数。

public function _getUserPassword($user_name){

    $data = array();

    $this->db->select('PASSWORD');
    $this->db->from('tbl_user');
    $this->db->where('USER_NAME', $user_name);
    $query = $this->db->get();

    if($query->num_rows() > 0){

        foreach($query->result_array() as $field_name => $field_value){
            $data = $field_value;
        }

        return $data;
    }
    else{

        return false;
    }
}

I've seen your's just selecting it.

我们需要使用那个 _getUserPassword 函数，我们称之为 verify 函数

    function verify($username, $password){

    $data = array();

    $userNameExists = $this->_getUserPassword($username);

    if(password_verify($password, $userNameExists['PASSWORD'])){

        $this->db->select('*');
        $this->db->from('tbl_user AS user');
        $this->db->where('USER_NAME', $username);
        $query = $this->db->get();

        if($query->num_rows() > 0){

            foreach($query->result_array() as $field_name => $field_value){
                $data = $field_value;
            }

            return $data;
        }
        else{

            return false;
        }
    }
    else{

        return false;
    }
}

So if the verification is success it will return the data to your controller, Let's use your controller.

Let's assume that you changed the models

在您的控制器上

public function login()
   {

    $this->form_validation->set_rules('username','Username','required');
    $this->form_validation->set_rules('password','Password','required');

    if($this->form_validation->run()=== FALSE){
    $this->load->view('templates/header');
    $this->load->view('users/login',$data);
    $this->load->view('templates/footer');

}else {

    //Getting username
    $username = $this->input->post('Username');
    //Getting and ecrypting password
    $password = $this->input->post('Password');
    $user_id = $this->user_model->verify($username,$password);

    //checking for user/pass correct will set session if so
    if($user_id){

    $this->session->set_userdata('user_loggedin','You are now logged in');
    redirect('posts');

    }else{
   //DO NOT SET USER DATA SESSION HERE UNLESS IT WILL AUTOMATICALLY LOGGED IN.

    redirect('users/login');

    }
  }
 }

希望对您有所帮助！

password_verify() 一直在登录

password_verify() logging in all the time

php

codeigniter

bcrypt