使用 bcrypt 登录身份验证

Question

我有一个使用 Laravel 构建的网络应用程序。我正在另一个网站上工作，但不使用 Laravel。我需要使用 Laravel 站点数据库上的用户 table 对这个新站点上的用户进行身份验证。密码使用 bcrypt 散列。

我试图在用户登录之前验证密码，但我似乎遗漏了一些东西。有人可以帮忙吗？

<?php 

if (isset($_POST['login'])) {
    $user  = mysqli_real_escape_string($_POST['email']);
    $pass  = mysqli_real_escape_string($_POST['password']); //input entered
    $dpass = password_hash('$pass', PASSWORD_DEFAULT)."\n";
    echo $dpass;
    
    $query   = mysqli_query($conn, "SELECT * FROM users WHERE `email` = '$user' AND `password` ='$pass'");
    $numrows = mysqli_num_rows($query);

    if ($numrows != 0) {
        while ($row = mysqli_fetch_assoc($query)) {
            $dbemail    = $row['email'];
            $dbpassword = $row['password'];
        }
        if ($user === $dbemail && password_verify($pass, $dbpassword)) {
            session_start();
            $_SESSION['email'] = $username;
            // Redirect Browser
            header("Location:mentor.php");
        }
    } else {
        echo "<div class='alert alert-danger alert-dismissible'>
            <a href='#' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
            <strong>Warning!</strong> Invalid credentials.
        </div>";
    }
}

?>

Answer 1

不确定，但你试过了吗

password_verify(mysqli_real_escape_string($_POST['password']), $dbpassword)

我的意思是将未加密的密码与哈希进行比较。在laravel

Hash::check()

还需要非散列密码作为参数。

Answer 2

根据以上评论的建议，我得出了这个有效的方法。

 <?php 
                        if(isset($_POST['login'])){
                         $user = mysqli_real_escape_string($conn,$_POST['email']);
                         $pass = mysqli_real_escape_string($conn,$_POST['password']); //input entered

                         $query = mysqli_query($conn, "SELECT * FROM users WHERE `email` = '$user'");
                         $numrows = mysqli_num_rows($query);
                         if($numrows !=0)
                         {
                         while($row = mysqli_fetch_assoc($query))
                         {
                         $dbemail=$row['email'];
                         $dbpassword=$row['password'];
                         }
                         if(password_verify($pass, $dbpassword))
                        {
                         session_start();
                         $_SESSION['email'] = $username;
                         //Redirect Browser
                         
                         }
                         }
                         else
                         {
                        echo "<div class='alert alert-danger alert-dismissible'>
                          <a href='#' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
                          <strong>Warning!</strong> Invalid credentials.
                        </div>";
                         }
                        }?>

使用 bcrypt 登录身份验证

Login authentication with bcrypt

php

laravel

bcrypt