如何在我的代码中使用密码验证来更正错误

Question

我正在尝试登录表单。 但每次我尝试登录时，总会给出一条错误消息，指出我的密码不正确。 我使用md5在数据库中哈希我的密码。

我试图将hash和password_verify删除到我的代码，但它会自动以不正确的passowrd登录用户

<?php

if (isset($_POST['login-submit'])) {

require 'dbh.inc.php';

$mailuid = $_POST['mailuid'];
$password = $_POST['pwd'];

if (empty($mailuid) || empty($password)){
    header("Location: ../systemlogintut/index1.php?error=emptyfields");
    exit(); 
}
else {
    $sql = "SELECT * FROM users WHERE uidUsers=? OR emailUsers=?;";
    $stmt = mysqli_stmt_init($conn);
    if (!mysqli_stmt_prepare($stmt, $sql)) {
        header("Location: ../systemlogintut/index1.php?error=sqlerror");
    exit(); 
    }
    else {

        mysqli_stmt_bind_param($stmt, "ss", $mailuid, $password);
        mysqli_stmt_execute($stmt);
        $result = mysqli_stmt_get_result($stmt);
        if ($row = mysqli_fetch_assoc($result)) {
            $pwdCheck = password_verify($password, $row['pwdUsers']);
            if ($pwdCheck == false) {
            header("Location: ../systemlogintut/index1.php?error=wrongpwd");
            exit();     
            }
            else if ($pwdCheck == true) {
                session_start();
                $_SERVER['userId'] = $row['idUsers'];
                $_SERVER['userUid'] = $row['uidUsers'];
                header("Location: ../systemlogintut/index1.php?login=success");
            exit();
            }
            else {
            header("Location: ../systemlogintut/index1.php?error=wrongpwd");
            exit();
            }
        }
        else {
            header("Location: ../systemlogintut/index1.php?error=nouser");
            exit(); 
        }
    }
  }
}
else {
  header("Location: ../systemlogintut/index1.php");
  exit();
}

Answer 1

您将自动登录用户，更改此行中的重定向代码

if ($row = mysqli_fetch_assoc($result)) 
{
   $pwdCheck = password_verify($password, $row['pwdUsers']);
     if ($pwdCheck == false) {
        header("Location: ../systemlogintut/index1.php?error=wrongpwd"); // change the redirection here
     exit();     
}

Answer 2

我只是将它改为：

$hashedPwd = password_hash($password, PASSWORD_DEFAULT);

而不是使用：

$hashedPwd = mb5($password, PASSWORD_DEFAULT);

Answer 3

试试吧$ password = md5（$ _ POST ['pwd']）;