Question

我编写了以下loginCheck代码，我使用的数据库模式如下：用户信息：用户名varchar 密码varchar

代码：

   <?php
    //set the MIME type to application/json
    //header("Content-Type: application/json");

    //get the username and password
    $username = $_POST['username'];
    $password = $_POST['password'];

    //require database operation
    require 'database.php';

    $stmt = $mysqli->prepare ("SELECT username, password, COUNT(*) FROM userinfo WHERE username=?");

    if(!$stmt){
        echo json_encode(array(
            "success" => false,
            "message" => "an error occured, please try again"
        ));
        exit;       
    }

    $stmt->bind_param('s', $username);

    $stmt->execute();

    $stmt->bind_result($returnedUsername, $hashedPassword, $count);

    $stmt->fetch();

    if ($count==1 && crypt($password, $hashedPassword) == $hashedPassword) {
        //all information provided is correct, start a session
        ini_set("session.cookie_httponly", 1);
        session_start();

        $previous_ua = @$_SESSION['useragent'];
        $current_ua = $_SERVER['HTTP_USER_AGENT'];
        $_SESSION['username'] = $username;

        if(isset($_SESSION['useragent']) && $previous_ua !== $current_ua){
           die("Session hijack detected");
        } else{
           $_SESSION['useragent'] = $current_ua;
        }

        //create a token
        $_SESSION['token'] = substr(md5(rand()), 0, 10);
        echo json_encode(array(
            "success" => true,
            "token" => htmlentities($_SESSION['token']),
            "username" => htmlentities($_SESSION['username'])
        ));
        exit;
    } else {
        echo json_encode(array(
            "success" => false,
            "message" => "Incorrect Username or Password"
        ));
        exit;
    }

    $stmt->close();
?>

网址是： http://ec2-54-148-227-9.us-west-2.compute.amazonaws.com/~beibeixhb/Calendar/calendar.php

我不确定为什么它阻止我登录，有什么建议吗？

Answer 1

您使用密码的哈希版本作为输入密码的盐，并且您希望它与哈希密码相同。我认为这不会发生。

crypt($password, $hashedPassword) == $hashedPassword

从你的代码中你不清楚你从哪里得到盐，但是如果你没有使用salt来开始密码，那么取出crypt的第二个参数就应该为你做好准备。

或者，使用正确的盐作为crypt的第二个参数。

登录检查问题

1 个答案: