如何正确使用password_verify（）？

Question

我正在尝试制作一个Login / Signup系统（在与索引相同的页面上，使用z-index），并且注册if（function）效果很好，因为我可以看到哈希密码完美地存储在数据库中，但是我不这样做。在password_verify字段中看不到我要去哪里。 另外，为了我的用户的安全起见，$ db变量中标有登录名和本地主机端口信息。

if (session_status() == PHP_SESSION_NONE) {
    session_start();
}
$db = mysqli_connect('localhost:****', '********_******M', 'W***********', '****logins');
if(isset($_POST['log'])) {
    $username = mysqli_real_escape_string($db, $_POST['usr']);
    $password = mysqli_real_escape_string($db, $_POST['pass']);
    $errors = array();

    if (empty($username)) {
         array_push($errors, "Username is required");
    }
    if (empty($password)) {
         array_push($errors, "Password is required");
    }

    if (count($errors) == 0) {
        $user_check_query = "SELECT * FROM users WHERE username='$username'";
        $result = mysqli_query($db, $user_check_query);
        $user = mysqli_fetch_assoc($result);

  if ($user) { // if user exists
    if (password_verify($password, $user['password'])) {
        $login = true;
        $_SESSION['username'] = $username;
    } else {
        $login = false;
    }
}
    if (mysqli_num_rows($results) == 1) {
        $_SESSION['username'] = $username;
        $login = true;
    }else {
        array_push($errors, "Wrong username/password combination");
        $login = false;
    }
}
//MySQL compare info
} else if(isset($_POST['signup'])) {
    $username = "";
    $email    = "";
    $errors = array(); 

    // connect to the database
    // REGISTER USER
    // receive all input values from the form
    $username = mysqli_real_escape_string($db, $_POST['username']);
    $email = mysqli_real_escape_string($db, $_POST['email']);
    $password_1 = mysqli_real_escape_string($db, $_POST['password']);
    $password_2 = mysqli_real_escape_string($db, $_POST['confirmpass']);
    $bio = mysqli_real_escape_string($db, $_POST['bio']);
    // form validation: ensure that the form is correctly filled ...
    // by adding (array_push()) corresponding error unto $errors array
    if (empty($username)) { array_push($errors, "Username is required"); }
    if (empty($email)) { array_push($errors, "Email is required"); }
    if (empty($password_1)) { array_push($errors, "Password is required"); }
    if ($password_1 != $password_2) {
        array_push($errors, "The two passwords do not match");
    }

  // first check the database to make sure 
  // a user does not already exist with the same username and/or email
  $user_check_query = "SELECT * FROM users WHERE username='$username' OR email='$email' LIMIT 1";
  $result = mysqli_query($db, $user_check_query);
  $user = mysqli_fetch_assoc($result);

  if ($user) { // if user exists
        if ($user['username'] === $username) {
       array_push($errors, "Username already exists");
  }

  if ($user['email'] === $email) {
     array_push($errors, "email already exists");
  }
  $login = false;
}

// Finally, register user if there are no errors in the form
if (count($errors) == 0) {
    $password = password_hash($password_1, PASSWORD_DEFAULT);//encrypt the password before saving in the database

    $query = "INSERT INTO users (username, email, password, bio) 
          VALUES('$username', '$email', '$password', '$bio')";
    mysqli_query($db, $query);
    $_SESSION['username'] = $username;
    $_SESSION['bio'] = $bio;
} else if(isset($_SESSION['active'])) {
    $username = $_SESSION['username'];
} else {
    $username = "Guest";
}
if($login === false) {
    $username = "Guest";
}

编辑：我的html如下。

<html>
<head>
    <link href="global.css" rel="stylesheet" />
    <title>Matrix-Hub</title>
</head>
<body>
    <!-- Soon to be login/signup page goes here -->
    <div id="login">
        <form class="login" method="post" action="" name="login" id='log'>
            <p>Username:</p>
            <input type="text" name="usr" placeholder="username" />
            <p>Password:</p>
            <input type="password" name="pass" placeholder="password" />
            <br>
            <input type="submit" name="log" value="Log In" />
            <button type="button" onclick="switchtoSign()">Sign Up</button>
        </form>
        <form class="login" style='display:none;' method="post" action="" name="sign" id="signup">
            <p>Username:</p>
            <input type="text" name="username" placeholder="username" />
            <p>Password:</p>
            <input type="password" name="password" placeholder="Password" />
            <p>Confirm Password:</p>
            <input type="password" name="confirmpass" placeholder="Confirm" />
            <p>Email:</p>
            <input type="text" name="email" placeholder="Email..." />
            <p>Bio:</p>
            <textarea name="bio" placeholder="optional"></textarea>
            <input type="submit" name="signup" value="Sign Up" />
        </form>
    </div>
    <!-- Header -->
    <header class="main">
        <h1>Matrix-Hub: Home</h1>
        <nav>
            <center>
                <ul>
                    <li><a class="active" href="index.php">Home</a></li>
                    <li><a href="stylesheets.php">Stylesheets</a></li>
                </ul>
            </center>
        </nav>
    </header>
    <!-- Body - document - About - Other -->
    <div class="net">
        <center>
            <div class="document">
                <h1>About Matrix-Hub</h1>
                <h2>Stylesheets and More!</h2>
                <p>Matrix-Hub is a website, made by InsaneMatrix, for you to download
        , and soon post your own stylesheets. Currently sign-up and login systems
        are under development</p>
            </div>
            <div class="menu">
                <button class="item" onclick="document.getElementById('login').style.display='block'" type="button">
                Login / Signup
                </button>
                <a class="item" href="profile.php?username=<?php echo $username ?>">Profile: <?php echo $username; ?></a>
                <a class="item" href="styles/vintage/Vintage.html">Vintage - Style Sheet</a>
            </div>
        </center>
    </div>
    <div class="users">
        <h2>There are other people who love web design! You can check out their profiles too!</h2>
    </div>
    <script>
        function switchtoSign() {
            document.getElementById('log').style.display='none';
            document.getElementById('signup').style.display='block';
        }
    </script>
</body>
</html>

Answer 1

（这应该是评论，但是有点长）

快速浏览一下代码，您似乎可以在成功登录后应用注册过程-但是，我不能真的那么仔细地检查所有代码。 您无需编写代码就可以让计算机理解，而无需编写代码供人们理解-这需要分解为离散的操作（作为函数或方法）。

开头为if (mysqli_num_rows($results) == 1) {似乎允许任何人进行身份验证，以提供带有无效密码的有效电子邮件，从而覆盖password_verify操作的结果。

您所申请的password_hash功能密码创建用户，当你用mysqli_real_escape_string逃脱后 。 如果您在验证密码时遇到相同的错误，这似乎可以正常工作-但仍然错误。 在散列之后应用转义符。

将代码分成不同的关注点：

 $login=false;
 $errors=array();
 if ($_POST['log']) {
    check_username_and_password($username, $password, $errors);
 } else if ($_POST['signup']) {
    create_account($username, $pass1, $pass2, $errors);
 }
 if (count($errors)) {
    display_errors($errors);
    exit;
 } else {
    $_SESSION['username'] = $username;
    $login = true;  
 }

 function check_username_and_password($username, $password, &$errors)
 {
 ...

当问一个问题时，请描述您当前的实现如何表现/失败以满足您的期望。

Answer 2

if (mysqli_num_rows($results) == 1) {永远不会是真实的，因为从未定义变量$results 。 因此，即使使用有效的密码，您的代码也会进入}else{语句，并且$login变为false 。

尝试将if (mysqli_num_rows($results) == 1) {换为if( $login ){ 。

顺便说一句，您的代码很难阅读。 您可能应该对其进行一些审查。

Answer 3

首先，忘记mysqli_real_escape_string而改用准备好的语句。

$username = $_POST['usr'];
$password = $_POST['pass'];

我也不明白为什么人们使用函数array_push而不是直接语法。 它执行速度更快，编写起来更短：

if (empty($username)) {
     $errors[] = "Username is required";
}

现在准备语句：

if ($stmt = mysqli_prepare($link, "SELECT * FROM users WHERE username= ?")) {
   mysqli_stmt_bind_param($stmt, "s", $username);
   if(!mysqli_stmt_execute($stmt)){
     die("Oooh nohhh, something happened to mysql query but I never would have found out if I didn't have this message because I failed checking the output of mysqli_query()");
   }
}

您的SQL注入会自动解决。

现在针对您的问题，应该直接从用户生成密码哈希。 您正在转义，这样做是完全错误的。 保留用户输入的密码并对其进行哈希处理并存储。 和VERIFY具有相同的未转义值。

然后是这段代码：

if (mysqli_num_rows($results) == 1) {

我们在说什么$results ？ 从未定义。 因此，这将始终导致错误的登录。

您还期望从此代码中得到什么？

$user['username'] === $username

您是否期望布尔值？ 显然，它将返回一个字符串，使用===运算符毫无意义。

我所看到的代码有些脆弱，请修复您的SQL代码并使用准备好的语句。 其余的似乎很好。