可以使用 PHP 的 password_hash 在 SQL 中设置默认用户的密码吗？

Question

My old PHP app has a default admin user and md5 encrypted password created by the SQL that creates the database: insert into users values ( 1, 'admin', MD5('changeMe'), 2 );

Is there a simple way to include a default user and encrypted password using PHP's passowrd_hash function on creating the tables? I ask because I understand that password_hash is a native PHP function and I assume it won't be understood in SQL.

Answer 1

The solution to my problem came in three parts. My OP sought a simple way to create a hashed password for the admin user for insertion in the MySQL database on the installation of the application, using the native PHP password_hash() function.

(1) Based on a suggestion by @Nick and @Tadman, I decided to incorporate setting the hash in an installer script that would set not only the hash but other defined site/application variables.

Rather than inserting user values when the database table is created, it was deferred until immediately after, with the admin user entering their credentials in the form that inserts the hash and writes other definitions to a file:

$userpass = $_POST['userpass'];
echo password_hash($userpass, PASSWORD_BCRYPT);

(2) The second part of my problem was replacing all instances of md5()`` with password_hash()` and I achieved that by using a neat PHP script I found online to recursively search and replace the occurrences on the server.

Having replaced the md5() occurrences, I needed to change the hash comparison method and again by searching the relevant files I was able to replace instances of:

if ($p != $theUser->pwd ) {
    return( false );     }

with:

if(password_verify($p, $theUser->pwd)) {
    // Success!
    }
else {
    // Invalid credentials
echo "Uh oh!";
    }

(3) The third step in resolving the problem was discovering that adding $1$ to the opening of the md5 hash could make it readable by password_hash(); so I just needed to make a couple of adjustments in the installed database to the admin user's old password.

Thanks to those who helped shine the light so I could find my way. I'm off now to invent the wheel and sliced bread.

Answer 2

you can do something like this in php:

$hash = password_hash('changeMe'); 
//echo $hash; 

then use this hash in the Database.