Question

我正在设置一个注册表单并使用密码哈希api，这是我所阅读的，目前是保护密码的最佳方法。

我的表格是

    <form action="register.php" method="post">
        <div class="fluid reg_firstname">
            <label for="first-name">First Name</label>
            <input name="first-name" type="text" style="width:90%;">
        </div>

        <div class="fluid reg_lastname">
            <label for="last-name">Last Name</label>
            <input name="last-name" type="text" style="width:90%;">
        </div>

        <div class="fluid reg_email">
            <label for="email">Email</label>
            <input name="email" type="text" style="width:50%;">
        </div>

        <div class="fluid reg_password">
            <label for="create-password">Create Password</label>
            <input name="create-password" type="password" style="width:70%;">
        </div>
        <div class="fluid reg_password">
            <label for="confirm-password">Confirm Password</label>
            <input name="confirm-password" type="password" style="width:70%;">
        </div>

        <div class="fluid reg_agreement">
        <p>
        By clicking 'Submit' I agree that:
        </p>
        <ul>
            <li>I accept the User Agreement- opens in a new window or tab.</li>
            <li>I give consent to the processing of my data- opens in a new window or tab.</li>
            <li>I may receive communications from SLF and I understand that I can change my notification preferences at any time in My Account.</li>
            <li>I am at least 18 years old.</li>
        </ul>
        </div>

        <div class="fluid reg_submit">
            <input name="step1" type="submit" value="Submit">
        </div>
    </form>

所以，一旦按下提交按钮，我就会在表单中添加一些验证，如下所示

<?php if(isset($_POST['step1']))
{
    #RETRIEVE VARIBLES
    $first = mysqli_real_escape_string($db,$_POST['first-name']);
    $last = mysqli_real_escape_string($db,$_POST['last-name']);
    $email = mysqli_real_escape_string($db,$_POST['email']);
    $password1 = password_hash($_POST['create-password'], PASSWORD_DEFAULT);
    $password2 = password_hash($_POST['confirm-password'], PASSWORD_DEFAULT);


    #VALIDATION CHECKS

    if($first == "")
    {
        $error[] = "Please Enter First Name";
    }
    if(strlen($first) < 2 OR strlen($first) > 16)
    {
        $error[] = "Name between 2 and 16 chars long";
    }
    if(!ctype_alnum ( $first ))
    {
        $error[] = "Letters Only Please";   
    }       

    if($last == "")
    {
        $error[] = "Please Enter Last Name";
    }
    if(strlen($last) < 2 OR strlen($last) > 16)
    {
        $error[] = "Surname between 2 and 16 chars long";
    }
    if(!ctype_alnum ( $last ))
    {
        $error[] = "Letters Only Please";   
    }

    if($email == "")
    {
        $error[] = "Please Enter Vaild Email";
    }
    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) 
    {
        $error[] = "Invalid email format";
    }

    if($password1 == "")
    {
        $error[] = "Please enter a valid password";
    }   

    if($password1 <> $password2)
    {
        $error[] = "Passwords Dont Match";
    }


    if(isset($error) && (count($error) >0))
    {
        echo "<pre>";
        print_r($error);
        echo "</pre>";
    }

    echo "step one complete<br />";
    echo $password1."<br />".$password2;
}?>

我遇到的问题是我的密码检查

if($password1 <> $password2)
{
    $error[] = "Passwords Dont Match";
}

我正在检查这两个变量是否匹配，但我猜测是因为我已经将password_hash添加到它们，它正在检查哈希值而不是用户输入的实际值？我将如何纠正这一点，以便检查实际数据而不是哈希值（永远不会匹配）？

感谢任何帮助！

干杯

Answer 1

如果你想测试原始数据，为什么不直接测试原始数据？

if($_POST['create-password'] <> $_POST['confirm-password'])
{
    $error[] = "Passwords Dont Match";
}

我错过了什么吗？

PHP 5.5 Password Hashing API比较2个password_hash（）变量的正确方法

1 个答案: