Question

我使用PHP和mySQLi编写了简单的登录脚本。问题是password_verify()函数返回空变量。我已经仔细检查了一切，但我没有看到它。问题出在哪儿？

session_start();

if (isset($_POST["submit"])) {

    include_once("dbh.inc.php");

    // Get data from POST request
    $uid = mysqli_real_escape_string($conn, $_POST["uid"]);
    $passwd = mysqli_real_escape_string($conn, $_POST["passwd"]);

    // Check if fields are empty
    if (empty($uid) || empty($passwd)) {
        echo "One or more of inputs was left blank";
        exit();
    } else { 
        $result = mysqli_query($conn, "SELECT * FROM users WHERE uid='$uid' OR email='$uid';");
        if (mysqli_num_rows($result) < 1) {

            // Forward to login page with GET failed=notFound
            header("Location: ../login.php?failed=notFound");
            exit();
        } else {
            if ($row = mysqli_fetch_assoc($result)) {
                $pwdCheck = password_verify($passwd, $row["pwd"]);
                if (!$pwdCheck) {
                    header("Location: ../login.php?failed=pwd");
                    exit();
                } elseif ($pwdCheck) {

                    // Login here
                    $_SESSION["id"] = $row["id"];

                    // Forward to login page with GET failed=0
                    header("Location: ../login.php?failed=0");
                    exit();
                }
            }
        }
    }
} else {
    header("Location: ../login.php");
    exit();
}

Answer 1

1）确保您正在获取正确的详细信息

2）确保在插入数据库时使用（password_hash（$ passwd，PASSWORD_DEFAULT））正确散列密码

3）还要确保密码列的长度足以接受整个哈希密码长度

4）并且还避免使用mysql_escape_string（$ _ post [＆＃39; passwd＆＃39;]）一些服务器不接受它尝试使用htmlspecialchars_decode（trim（$ _ post [＆＃39; passwd＆＃39] ;]））;

password_verify（）函数返回空var

1 个答案: