嘿，我最近被告知md5对于密码是不够的，所以我已经开始改变它了。目前这是我的注册脚本的代码：
<?
session_start();
include 'db.php';
// Define post fields into simple variables
$first_name = $_POST['first_name'];
$last_name = $_POST['last_name'];
$username = $_POST['username'];
$email_address = $_POST['email_address'];
$password = $_POST['password'];
$confirm_password = $_POST['confirm_password'];
/* Let's strip some slashes in case the user entered
any escaped characters. */
$first_name = stripslashes($first_name);
$last_name = stripslashes($last_name);
$username = stripslashes($username);
$email_address = stripslashes($email_address);
if((!$username) || (!$email_address)){
echo 'You did not submit the following required information! <br />';
if(!$username){
echo "Username is a required field. Please enter it below.<br />";
}
if(!$email_address){
echo "Email Address is a required field. Please enter it below.<br />";
}
include 'register.html'; // Show the form again!
/* End the error checking and if everything is ok, we'll move on to
creating the user account */
exit(); //if the error checking has failed, we'll exit the script!
}
if ( $password <> $confirm_password ){
echo "<br /><strong><div style=color:#FF0000;><center>Password and confirm password do not match!<BR></center></div></strong>";
include 'register.html';
exit();
}
/* Let's do some checking and ensure that the user's email address or username
does not exist in the database */
$sql_email_check = mysql_query("SELECT email_address FROM users WHERE email_address='$email_address'");
$sql_username_check = mysql_query("SELECT username FROM users WHERE username='$username'");
$email_check = mysql_num_rows($sql_email_check);
$username_check = mysql_num_rows($sql_username_check);
if(($email_check > 0) || ($username_check > 0)){
echo "<br /><div style=color:#FF0000;><center>Please fix the following errors: </div><br /><br />";
if($email_check > 0){
echo "<strong><div style=color:#FF0000;><center>Your email address has already been used by another member in our database. Please submit a different Email address!</div><br />";
unset($email_address);
}
if($username_check > 0){
echo "<strong><div style=color:#FF0000;><center>The username you have selected has already been used by another member in our database. Please choose a different Username!</div><br />";
unset($username);
}
include 'register.html'; // Show the form again!
exit(); // exit the script so that we do not create this account!
}
/* Everything has passed both error checks that we have done.
It's time to create the account! */
$db_password = password_hash($passwod, PASSWORD_DEFAULT);
// Enter info into the Database.
$info2 = htmlspecialchars($info);
$sql = mysql_query("INSERT INTO users (first_name, last_name, email_address, username, password, signup_date)
VALUES('$first_name', '$last_name', '$email_address', '$username', '$db_password', now())") or die (mysql_error());
if(!$sql){
echo 'There has been an error creating your account. Please contact the webmaster.';
} else {
$userid = mysql_insert_id();
// Let's mail the user!
$subject = "Activation";
$message = "Dear $first_name $last_name,
Thank you for registering
To activate your membership, please click here: http://activate.php?id=$userid&code=$db_password
Once you activate your memebership, you will be able to login with the following information:
Username: $username
Password: $password
This is the first step towards a steady income from sports betting. Congratulations!
Thanks!
The Team
This is an automated response, please do not reply!";
mail($email_address, $subject, $message, "From: Activation<activation@y.com>\nX-Mailer: PHP/" . phpversion());
echo "<br /><div style=color:#0000FF;><center>Your membership information has been mailed to your email address! Please check it and follow the directions!</div>";
include 'login.html';
}
?>
这是检查用户脚本：
<?
/* Check User Script */
session_start(); // Start Session
include 'db.php';
// Conver to simple variables
$username = $_POST['username'];
$password = $_POST['password'];
if((!$username) || (!$password)){
echo "Please enter ALL of the information! <br />";
include 'login.html';
exit();
}
if (password_verify($password, $db_password)) {
// Success!
}
else {
echo "Invalid Credentials";
include 'login.html';
exit();
}
// check if the user info validates the db
$sql = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password' AND activated='1'");
$login_check = mysql_num_rows($sql);
if($login_check > 0){
while($row = mysql_fetch_array($sql)){
foreach( $row AS $key => $val ){
$key = stripslashes( $val );
}
// Register some session variables!
//session_register('email_address');
$_SESSION["username"] = $username;
$_SESSION["email_address"] = $email_address;
//session_register('special_user');
$_SESSION["user_level"] = $user_level;
mysql_query("UPDATE users SET last_login=now() WHERE userid='$userid'");
header("Location: daily_picks.php");
}
} else {
echo "<center><div style=color:#FF0000;>You could not be logged in! Either the username and password do not match or you have not validated your membership!<br />
Please try again!<br /></div></center>";
include 'login.html';
}
?>
现在我遇到了检查用户脚本的问题。当我点击登录时没有任何反应，它返回无效的凭据。这可能是因为我累了，但我在这里迷失了如何用这个密码实现密码密码_hash（）
感谢。
答案 0 :(得分：0)
正如您所说，您将密码存储为加密值。因此，在查询时，您必须使用相同的加密机制来生成密码，然后再应用于查询。
$sql = mysql_query("SELECT * FROM users WHERE username='$username' AND password='"+fun($password)+"' AND activated='1'");
fun（）是加密函数。
答案 1 :(得分：0)
也许检查你的password_verify。
if (password_verify($password, $db_password)) {
// Success!
}
else {
echo "Invalid Credentials";
include 'login.html';
exit();
}
答案 2 :(得分：0)
使用password_verify（）检查使用password_hash（）函数散列的密码。试试这个..
$hash = password_hash($password, PASSWORD_BCRYPT);
$sql = mysql_query("SELECT * FROM users WHERE username='$username' AND
password='$hash' AND activated='1'");
答案 3 :(得分：0)
if($login_check > 0){
// code
}
在此部分中，您将检查用户名，密码和激活是否正确，但如果您有2行，则他将设置会话但您只需要一个用户。而是使用＆＃39;＆gt; 0＆＃39;使用＆＃39; == 1＆＃39;。如果您只有一条记录，这将执行if语句。