如何使用加密密码登录php

Question

起初我使用 md5 进行散列，但后来我了解到 password_hash 更安全，但是当我尝试在我的网站上使用它时它不起作用。我试过将代码 password_verify 放在各处。

当我尝试登录时，它只是给我一个错误密码/电子邮件组合是错误的，即使它是正确的。我也收到密码验证错误，但是当我输入正确的凭据时，它仍然给我错误消息

这是我的登录码

  <?php
  function login(){
  global $db, $email, $errors;

  // grab form values
  $email = e($_POST['email']);
  $password = e($_POST['password']);

  // make sure form is filled properly
  if (empty($email)) {
    array_push($errors, "Email is required");
}else {
    $email = hsc($_POST["email"]);
}

if (empty($password)) {
    array_push($errors, "Password is required");
}else{
    $password = hsc($_POST["password"]);
}

// attempt login if no errors on form
if (count($errors) == 0) {
    $query = "SELECT * FROM accounts WHERE email='$email' AND password='$password' LIMIT 1";
    $results = mysqli_query($db, $query);

if (password_verify($password, $_POST["password"])) {
  array_push($errors, "Wrong password");
}

    if (mysqli_num_rows($results) == 1) { // user found
        // check if user is admin or user
        $logged_in_user = mysqli_fetch_assoc($results);
 
        if ($logged_in_user['user_type'] == 'admin') {

            $_SESSION['user'] = $logged_in_user;
            $_SESSION['success']  = "You are now logged in";

            header('location: admin/admin.php');
            exit(0);
        }else{
            $_SESSION['user'] = $logged_in_user;
            $_SESSION['success']  = "You are now logged in";

            header('location: index.php');
            exit(0);
        }

    }else {
        array_push($errors, "Wrong username/password combination");
    }
}
}

这是我的注册码（同一个文件里都有functions.inc.php）

      function register(){
        // call these variables with the global keyword to make them available in function
        global $db, $errors, $username, $email;

       // receive all input values from the form. Call the e() function
       // defined below to escape form values
     $username    =  e($_POST['username']);
     $email       =  e($_POST['email']);
     $password_1  =  e($_POST['password']);
     $password_2  =  e($_POST['re-password']);

  //check email if already exist on database
  $check = "SELECT * FROM accounts WHERE email='$email'";
  $res_e = mysqli_query($db, $check);

   // form validation: ensure that the form is correctly filled
   if (empty($username)) {
    array_push($errors, "Name is required");
    }elseif (!preg_match("/^[a-zA-Z]+( [a-zA-Z]+)*$/",$username)) {
    array_push($errors, "Only letters and one space only");
    }else{
    $username = hsc($_POST["username"]);
    }

   if (empty($email)) {
    array_push($errors, "Email is required");
    }elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    array_push($errors, "The email is invalid");
    }elseif (mysqli_num_rows($res_e) > 0) {
    array_push($errors, "The email already taken");
    }else{
    $email = hsc($_POST["email"]);
    }

   if (empty($password_1)) {
    array_push($errors, "Password is required");
    }elseif ($password_1 != $password_2) {
    array_push($errors, "The two passwords do not match");
    }else{
        $password_1 = hsc($_POST["password_1"]);
    }



   // register user if there are no errors in the form
  if (count($errors) == 0) {
    $hashpassword = password_hash($password_1, PASSWORD_DEFAULT);;//encrypt the password before 
    saving in the database

    if (isset($_POST['user_type'])) {
        $user_type = e($_POST['user_type']);
        $query = "INSERT INTO accounts (username, email, user_type, password) 
                  VALUES('$username', '$email', '$user_type', '$hashpassword')";
        mysqli_query($db, $query);

        $_SESSION['add']  = "Added successfully";
        header('location: users.php');
        exit(0);
    }else{
        $query = "INSERT INTO accounts (username, email, user_type, password) 
                  VALUES('$username', '$email', 'user', '$hashpassword')";
        mysqli_query($db, $query);

        // get id of the created user
        $logged_in_user_id = mysqli_insert_id($db);
        $_SESSION['user'] = getUserById($logged_in_user_id); // put logged in user in session
        $_SESSION['add']  = "You are now logged in and thank you!";

        header('location: index.php');
        exit(0);
    }
}

}

我不知道这是否也是登录不起作用的原因，但我把它放在里面更好。这是函数 hsc() 和 e() 的代码

// escape string
function e($val){
global $db;
return mysqli_real_escape_string($db, trim($val));
}

// htmlspecialchars the inputs data
function hsc($val) {
$val = htmlspecialchars($val);
return $val;
}

Here is the data base photo

Answer 1

（迄今为止最简单的方法...）试试这个例子。它使用 Argon2，这是迄今为止最安全的加密方法 (AFAIK)

请注意，它会在运行时随机生成一个 不同的字符串 ，因此使用 password_verify 是强制性的，这与使用 sha-256 查找密码不同数据库

<?php
$pwd = password_hash("my password goes here", PASSWORD_ARGON2I);
// Use $_POST instead
echo $pwd;
?>

并验证您的密码：

if(password_verify($_POST['password'], $row["password"])) {
 // Your code here... 
}

此外，使用 PDP PDO，它更安全地抵御 SQL 注入攻击

<?php
$db = new PDO('mysql:host='.$servername.';dbname='.$dbname.';charset=utf8mb4', $username, $password);
try {
  $query = "SELECT * from `login` WHERE `username`=:username OR `email` =:usernamea";
  $stmt = $db->prepare($query);
  $stmt->bindParam('username', $username, PDO::PARAM_STR);
  $stmt->bindParam('usernamea', $username, PDO::PARAM_STR);
  $stmt->execute();
  $count = $stmt->rowCount();
  $row   = $stmt->fetch(PDO::FETCH_ASSOC);
  if($count == 1 && !empty($row)) {
      $auth_email = $row['email'];
      $auth_pwd = $row['password'];
      if(password_verify($_POST['password'], $auth_pwd)) {
         $validuser = $row['username'];
         $_SESSION['valid'] = $validuser;
         $_SESSION['name'] = htmlspecialchars($row['name']);
      }
      else {
    echo 'Invalid';
     }
  } 
  else {
    echo 'Invalid';
  }
} 
catch (PDOException $e) { echo "Error : ".$e->getMessage(); }
?>

如何使用加密密码登录php

How to use the encrypt password for login php

php

authentication

password-hash