md5和哈希的问题

Question

<form action="inc/login/login.php" method="post" id="userLogon">
    <div class="field required">
        Username: <input type="text" name="regduser" tabindex="1" /><br />
        </div>
        <div class="field required">
        Password: <input type="password" name="regdpass" tabindex="2" /><br />
        </div>
        <input type="submit" name="submitUser" />
</form>

PHP

<?php
ob_start();
$host="localhost"; // Host name 
$username="root"; // Mysql username 
$password=""; // Mysql password 
$db_name="ureviewdu"; // Database name 
$tbl_name="Student"; // Table name

// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB");

// Define $myusername and $mypassword 
$myusername=$_POST['regduser']; 
$mypassword=$_POST['regdpass'];

// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);

$sql="SELECT * FROM $tbl_name WHERE uname='$myusername' and upass='$mypassword'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

if($count==1){
// Register $myusername, $mypassword and redirect to file "login_success.php"
session_register("regduser");
session_register("regdpass"); 
header("location:login_success.php");
}
else {
echo "Wrong Username or Password";
}

ob_end_flush();
?>

数据库提交

当我点击提交为用户输入joe joe并通过时。如何让php识别joe for pass实际上是'55abd89cb7ab6742370f0ad912fef335'？我如何让php能够解读这个？

任何？

Answer 1

SELECT * FROM $tbl_name WHERE uname='$myusername' and upass=MD5('$mypassword')

但是，我需要建议你阅读无畏领袖关于using salted passwords and stronger hashing functions的博客。不要实施弱安全性。

---

如果数据库中的密码已经加密，则需要在散列之前将明文密码与相同的salt 组合使用。理想情况下，每个用户都有自己独特的随机盐，与uname和upass存储在同一行中。然后你可以这样做：

SELECT * FROM $tbl_name WHERE uname='$myusername' 
  AND upass=MD5(CONCAT(usalt, '$mypassword'))

Answer 2

在途中哈希密码：

$sql = "SELECT * FROM $tbl_name
    WHERE uname = '$myusername' and upass = MD5('$mypassword')";

顺便说一句，如果您的系统尚未投入生产，我强烈建议您寻找更安全的哈希算法，例如SHA256。只要您能够刷新当前的密码记录，就不需要进行太多的更改：

$sql = "SELECT * FROM $tbl_name
    WHERE uname = '$myusername' and upass = SHA2('$mypassword', 256)";

Answer 3

直接回答您的问题，而不对更安全的内容发表意见：

  

当我点击提交为用户输入joe joe并通过时。我如何能   实际上，让php识别joe for pass   '55abd89cb7ab6742370f0ad912fef335'？我如何让PHP能够   破译这个？

$mypassword = md5(stripslashes($mypassword));

$sql="SELECT * FROM $tbl_name WHERE uname='$myusername' and upass='$mypassword'";
$result=mysql_query($sql);