[PHP]正确的密码,即使密码输入错误

时间:2019-11-30 18:42:33

标签: php mysql password-hash

我需要我的代码中的帮助

当我尝试登录时,总是显示密码正确并允许我登录,为什么?

session_start();
if(isset($_POST['submit'])){
    include_once'dbh.php';//connecting
    $student_id = mysqli_real_escape_string($conn,$_POST['student_id']) ;
    $student_password = mysqli_real_escape_string($conn,$_POST['student_password']) ;
     $sql = "SELECT * FROM students WHERE student_id='$student_id'";
     $result = mysqli_query($conn,$sql)or die(mysqli_error($conn));
     $resultCheck = mysqli_num_rows($result);
     if($resultCheck < 1){
        echo "<script> alert (' Student ID or Password incorrect. ')</script>";
         exit();
     }else{
         if($row = mysqli_fetch_assoc($result)){
            //dehashing the password    
            $hashed = password_hash('student_password', PASSWORD_DEFAULT);
$student_password = 'student_password';
if (password_verify($student_password, $hashed)) {
 $_SESSION['s_id'] = $row['student_id'];
    $_SESSION['s_password'] = $row['student_password'];
    $_SESSION['s_name'] = $row['studentname'];
    header("Location: ../StudentHomePage.php?login=success");
    exit();
} else {echo "<script> alert (' Student ID or Password incorrect. ')</script>";
         exit();
} }}}```

0 个答案:

没有答案