创建一个博客，但MySQL的PHP密码问题
[英]creating a blog but mysql php password issues
问题描述
I am creating a blog from scratch using mysql and php. 
我正在使用mysql和php从头开始创建博客。
class.user.php code: class.user.php代码：
<?php
class User{
private $db;
public function __construct($db){
$this->db = $db;
}
public function is_logged_in(){
if(isset($_SESSION['loggedin']) && $_SESSION['loggedin'] == true){
return true;
}
}
public function create_hash($value)
{
return $hash = crypt($value, '$2a$12$'.substr(str_replace('+', '.', base64_encode(sha1(microtime(true), true))), 0, 22));
}
private function verify_hash($password,$hash)
{
return $hash == crypt($password, $hash);
}
private function get_user_hash($username){
try {
//echo $this->create_hash('demo');
$stmt = $this->db->prepare('SELECT password FROM blog_members WHERE username = :username');
$stmt->execute(array('username' => $username));
$row = $stmt->fetch();
return $row['password'];
} catch(PDOException $e) {
echo '<p class="error">'.$e->getMessage().'</p>';
}
}
public function login($username,$password){
$hashed = $this->get_user_hash($username);
if($this->verify_hash($password,$hashed) == 1){
$_SESSION['loggedin'] = true;
return true;
}
}
public function logout(){
session_destroy();
}
}
?>
Login.php that connects to class.user.php 连接到class.user.php的Login.php
<?php
//include config
require_once('../includes/config.php');
//check if already logged in
if( $user->is_logged_in() ){ header('Location: index.php'); }
?>
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Admin Login</title>
<link rel="stylesheet" href="../style/normalize.css">
<link rel="stylesheet" href="../style/main.css">
</head>
<body>
<div id="login">
<?php
//process login form if submitted
if(isset($_POST['submit'])){
$username = trim($_POST['username']);
$password = trim($_POST['password']);
if($user->login($username,$password)){
//logged in return to index page
header('Location: index.php');
exit;
} else {
$message = '<p class="error">Wrong username or password</p>';
}
}//end if submit
if(isset($message)){ echo $message; }
?>
<form action="" method="post">
<p><label>Username</label><input type="text" name="username" value="" /></p>
<p><label>Password</label><input type="password" name="password" value="" /></p>
<p><label></label><input type="submit" name="submit" value="Login" /></p>
</form>
</div>
</body>
</html>
I created the table using phpmyAdmin but However I try to login, it says wrong username and password. 我使用phpmyAdmin创建了该表，但是尝试登录时却显示错误的用户名和密码。 I cant get it to work. 我无法正常工作。 Is there any other workaround or other method to do this? 还有其他解决方法或其他方法吗？
Thanks 谢谢
2 个解决方案
解决方案1
1 2014-05-28 20:15:55
A couple of things... 几件事...
Why re-invent the wheel? 为什么要重新发明轮子？
Unless this is an exercise to gain knowledge, creating your own blog system is a bit extreme when there's plenty of well developed off the shelf solutions which will do what you want and more. 除非这样做是为了获得知识，否则，当有很多成熟的现成的解决方案可以满足您的需求和更多工作时，创建自己的博客系统会有些极端。
Back to your question... 回到您的问题...
When you create your user password for the account you need to store the salt in the database along with the hashed password. 在为帐户创建用户密码时，您需要将盐和哈希密码一起存储在数据库中。 Then when you come to check the authentication you get the salt and the hashed password from the database. 然后，当您检查身份验证时，将从数据库中获取盐和哈希密码。 You then hash the submitted password with the existing salt and check it matches the hashed password in the database. 然后，使用现有的盐对提交的密码进行哈希处理，并检查其是否与数据库中的哈希密码匹配。
What it appears you're currently doing is getting the hashed password from the database and then comparing it to crypt($password, $db_password) - which basically means you're hashing the user submitted password with the existing hashed password in the db, this of course will never match. 您当前正在执行的操作是从数据库中获取哈希密码，然后将其与crypt($password, $db_password) -这基本上意味着您正在将用户提交的密码与db中现有的哈希密码进行哈希运算，当然，这永远不会匹配。
解决方案2
0 2014-05-28 20:18:48
Possible answer: 可能的答案：
I recommend you re-read the documentation on crypt() , (they recommend using password_hash() instead of crypt() to begin with): http://us3.php.net/manual/en/function.crypt.php Also, as I understand it, including a time sensitive salt means that you have to have that same time in order to match the hash... if you are recording the creation date (as a timestamp) in the DB and you can be sure to pull that to re-create the hash then that could be very secure... otherwise, as I understand it, it will absolutely NOT work... remember a hash is meant to encrypt a specific value in a way that it is very difficult to find that value. 我建议您重新阅读crypt（）上的文档（建议您首先使用password_hash（）而不是crypt（））： http : //us3.php.net/manual/en/function.crypt.php ，据我了解，包含时间敏感盐意味着您必须具有相同的时间才能匹配散列...如果您正在数据库中记录创建日期（作为时间戳），并且可以确保将其拉出以重新创建散列，然后这将是非常安全的...否则，据我所知，它将绝对不起作用...请记住，散列旨在以非常困难的方式对特定值进行加密找到那个价值。 But generating a new hash that matches the old hash is easy so long as you use the SAME specific value that originally created the hash... again as I understand it, including the SAME salt. 但是只要您使用最初创建哈希的SAME特定值，就可以轻松生成与旧哈希匹配的新哈希，据我所知，包括SAME盐。
Comment about trim(): 关于trim（）的评论：
I have to back @WesleyMurch, it's definitely best not to modify the password... I have some experience with an edge case where I could see that using the default functionality of trim() on the password could be valuable. 我必须返回@WesleyMurch，绝对最好不要修改密码...我在一些极端情况下有一些经验，我可以看到在密码上使用trim（）的默认功能可能很有价值。 Under a very specific need &, so long as the users are made very aware that you will be modifying the password by removing the whitespace from the beginning or end of their passwords. 在一个非常特定的需求＆下，只要使用户意识到您将通过删除密码开头或结尾的空格来修改密码。 I actually have a password that I accidentally included a space & hard return in... took a while to figure that one out (I was copying & pasting from a password manager). 我实际上有一个密码，我不小心包含了一个空格，然后强行输入...花了一段时间才弄清楚这个密码（我是从密码管理器复制并粘贴的）。 I also would have to support @TheBlueDog in his comment that my experience is likely to be not a very likely case. 在他的评论中，我还必须支持@TheBlueDog，因为我的经历可能不太可能。 Most of the time, if your password didn't work because of un-intended white space you wouldn't know why and you'd reset your password, therefore side stepping the problem. 在大多数情况下，如果您的密码由于意外的空格而无法使用，您将不知道为什么，并且您将重置密码，因此避免了该问题。 In addition many people still don't use password managers and may not be routinely copying & pasting their passwords. 此外，许多人仍然不使用密码管理器，并且可能不会定期复制和粘贴他们的密码。
Again good luck! 再次祝你好运！
声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.