Question

我试图用他们的输入来验证用户哈希密码，但是我无法使其正常工作，到目前为止，如果用户具有该用户名但它只是不会验证密码。这是我的代码

    <?php
    $serverName = "localhost"; //Variables to access the user database
    $username = "root";
    $password = "";
    $database = "snake_database";
    $errors = []; //Array of all the errors to display to the user

    $conn = mysqli_connect($serverName, $username, $password, $database); //Connect to the database

    if(!$conn){ //If the database failed to connect

        die("Database failed to connect: " .mysqli_connect_error()); //Display an error message
    }

    $username = $_POST['username']; //set the username/ password varaibles
    $password = $_POST['password'];
    $hashPass = password_hash($password, PASSWORD_DEFAULT); //Encrypt the password

    $sql = "SELECT * FROM users WHERE username = ?"; //Select all usernames and passwords
    $stmt = $conn->prepare($sql);
    $stmt->bind_param("s", $username);
    $stmt->execute();
    $result = $stmt->get_result();
    $count = mysqli_num_rows($result); //Count how many results there are

    if ($count == 1)
    {
         $sql = "SELECT password FROM users WHERE username = ?";
        $stmt = $conn->prepare($sql);
        $stmt->bind_param("s", $username);
        $stmt->execute();
        $result = $stmt->get_result();

        if(password_verify($password, $result )){
            $count = 2;
        }
    }

    if($count == 2) //If there is 1 account that matches
    {
        $stmt->close(); //Close the statment and connection
        $conn->close();

        session_start();
        $_SESSION["LoggedUser"] = $username; //Log the user in
        $_SESSION["lastPage"] = "login.php";
        header("location: profile.php"); //Direct the user to their profile

    }else //if there is no accounts that match
    {
        array_push($errors, "Username or password is incorrect");
        session_start();    
        $_SESSION["loginErrors"] = $errors;
        $_SESSION["lastPage"] = "login.php"; //Make this page the last page
        header("location: index.php"); //Go to the homepage
    }
    ?>

感谢任何帮助，谢谢

Answer 1

你做了很多你不需要做的事情。

SELECT *将返回所有列，因此您不需要为密码执行另一个SELECT。

另外，在检查已存储在数据库中的密码时，不应再次password_hash()密码。使用password_verify()即可完成所有检查。因此，您将数据库中的hashed_password和用户刚刚在屏幕上输入的纯文本密码传递给它，它将返回true或false，告诉您输入的密码是否与数据库中的哈希值相匹配

<?php
// always do this early in the code
session_start();

$serverName = "localhost";
$username = "root";
$password = "";
$database = "snake_database";
$errors = []; //Array of all the errors to display to the user

$conn = mysqli_connect($serverName, $username, $password, $database); 

if(!$conn){ 
    die("Database failed to connect: " .mysqli_connect_error()); 
}

// dont hash password again 
//$hashPass = password_hash($password, PASSWORD_DEFAULT); 

$sql = "SELECT * FROM users WHERE username = ?"; 
$stmt = $conn->prepare($sql);
$stmt->bind_param("s",  $_POST['username']);
$stmt->execute();

$result = $stmt->get_result();

if ($result->num_rows == 1) {

    $row = $result->fetch_assoc();
    if(password_verify($_POST['password'], $row['password'] )){
    // ----------------^^^^^^^^^^^^^^^^^^--^^^^^^^^^^^^^^^^
    //                  Plain text pwd      hashed pwd from db  
        $_SESSION["LoggedUser"] = $_POST['username']; 
        $_SESSION["lastPage"] = "login.php";
        header("location: profile.php"); 
        // put exit after a redirect as header() does not stop execution
        exit;
    }

} else {
    $errors[] = "Username or password is incorrect";
    $_SESSION["loginErrors"] = $errors;
    $_SESSION["lastPage"] = "login.php";
    header("location: index.php"); 
    exit;
}
?>

无法验证用户哈希密码 - mysql＆amp; PHP

1 个答案: