[英]How do I encrypt this password with MD5 using PHP?
The code below is from a login script, written in PHP. 下面的代码来自用PHP编写的登录脚本。 The database that it checks passwords against encrypts the passwords using MD5 however when the login script checks against the database for a password, it is checking the raw password without encryption. 它检查密码的数据库使用MD5加密了密码,但是,当登录脚本针对数据库检查密码时,它正在检查未加密的原始密码。 I am familiar with the md5() function but how would I incorporate that into the following: 我熟悉md5()函数,但是如何将其合并到以下代码中:
<?php
session_start();
$username = $_POST['username'];
$password = $_POST['password'];
if ($username && $password) {
$connect = mysql_connect("host", "user", "password") or die("Couldn't connect");
mysql_select_db("dbname") or die("Couldn't find the database");
$query = mysql_query("SELECT * FROM users WHERE username='$username'");
$numrows = mysql_num_rows($query);
if ($numrows != 0) {
while ($row = mysql_fetch_assoc($query)) {
$dbusername = $row['username'];
$dbpassword = $row['password'];
}
if ($username == $dbusername && $password == $dbpassword) {
echo "You're in! Click <a href='../member.php'>here</a> to enter the member page.";
$_SESSION['username'] = $username;
}else{
echo "Incorrect password";
}
}else{
die("That username does not exist.");
}
}else{
die("Please enter a valid username and password.");
}
?>
You should be checking and querying the database for a match, not bringing the results down and checking them locally. 您应该检查和查询数据库是否匹配,而不是降低结果并在本地检查它们。 With that said: 照这样说:
$password = md5($_POST['password']);
Then also change: 然后还要更改:
SELECT * FROM users WHERE username='$username' AND password='$password'
But I'd also have a look at using PDO instead of placing the values directly in a SQL query. 但是我也将看看使用PDO而不是将值直接放在SQL查询中。 At the very least you should be using mysql_real_escape_string
to avoid injection attacks. 至少应该使用mysql_real_escape_string
避免注入攻击。
$salt=sha1($postpassword);
$arr= strlen($postpassword);
$count=ceil($arr/2);
$stringarr=str_split($postpassword,$count);
$password1=hash("sha512", $stringarr['0']);
$password2=$salt . ( hash( 'whirlpool', $salt . $stringarr['1'] ) );
return $password1.$password2;
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.