PHP 登录系统使用 PDO - password_hash 和 password_verify [重复]

Question

这个问题在这里已经有了答案：

我的 PDO 语句不起作用1 个回答

“注意：未定义的变量”、“注意：未定义的索引”和“注意：未定义的偏移量”使用 PHP （29 个答案）

1 年前关闭。

最近我一直在想办法为我的本地PHP 应用程序登录。

除了散列 email （我使用 email 进行散列而不是密码）之外，我已经完成了所有工作

没有散列的代码 -> （此代码没有任何散列）

• 形式

<?php
session_start();

require_once ("../controller/login_handler.php");
echo("<link rel='stylesheet' type='text/css' href='../stylesheet.css'>");

if(isset($message))
{
echo '<label class="text-danger">' .$message. '</label>';
}

?>


<html>

<form class="login" action="" method="post" name="login">
    <p>Naam</p> <input class="form-input" type="text" name="naam" minlength="3" placeholder="Voer hier jouw naam in"><br><br>
    <p>Email</p> <input class="form-input" type="email" name="email" minlength="7" placeholder="Voer hier jouw email in"><br><br>
    <br>
    <input class="submit-button" name="login" type="submit" value="Login">
</form>

<a href="./index.php">Ga terug naar homepage</a>

• dbcennect.php

<?php
    // POSTS
    $naam=isset($_POST['naam']) ? $_POST['naam'] : "";
    $email=isset($_POST['email']) ? $_POST['email'] : "";
    $tel=isset($_POST['tel']) ? $_POST['tel'] : "";
    $datum=isset($_POST['datum']) ? $_POST['datum'] : "";
    $tijd=isset($_POST['tijd']) ? $_POST['tijd'] : "";

if(isset($_POST['submittedd'])){
    $dbhost = '127.0.0.1';
    $dbname = '2019inklok';
    $dbuser = 'root';
    $dbpass = '';

    // Attempts to connect to DB
    try {
        $conn = new PDO("mysql:host=$dbhost;dbname=$dbname", $dbuser, $dbpass);
        $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
        echo"Connected succesfully<br>";


    // Error msg if doesnt connect
    } catch(PDOException $e) {
        echo"Connection failed" . $e->getMessage();
    }

    // Sets all data inside database
    $pdoQuery = "INSERT INTO `clocktime`(`naam`, `email`, `tel`, `datum`, `tijd`) VALUES (:naam,:email,:tel,:datum,:tijd)";
    $pdoResult = $conn->prepare($pdoQuery);
    $pdoExec = $pdoResult->execute(array(":naam"=>$naam,":email"=>$email,":tel"=>$tel,":datum"=>$datum,":tijd"=>$tijd,));

    if($pdoExec)
    {
        echo 'good job';
    }else{
        echo 'bad';
    }

    header("location: confirm.php");
}
?>

• login_handler.php

include_once ("../controller/db_cennection.php");
if(!isset($_SESSION)) 
{ 
    session_start(); 
} 

$dbhost = '127.0.0.1';
$dbname = '2019inklok';
$dbuser = 'root';
$dbpass = '';
$message = '';

// Attempts to connect to DB

try  
{  
     $connect = new PDO("mysql:host=$dbhost; dbname=$dbname", $dbuser, $dbpass);  
     $connect->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);  
     if(isset($_POST["login"]))  
     { 
           if(empty($_POST["naam"]) || empty($_POST["email"]))  
           {  
                $message = '<label>All fields are required</label>';  
           }  
           else  
           {  
                $query = "SELECT * FROM clocktime WHERE naam = :naam AND email = :email";  
                $statement = $connect->prepare($query);  
                $statement->execute(  
                     array(  
                          'naam'     =>     $_POST["naam"],  
                          'email'     =>     $_POST["email"]  
                     )  
                );  


                $count = $statement->rowCount();  
                if($count > 0)  
                {  
                     $_SESSION["naam"] = $_POST["naam"];  
                     header("location:loggedin.php");  
                }  
                else  
                {  
                     $message = '<label>Wrong Data</label>';  
                }  
           }  
      }  

 }   // Error msg if doesnt connect
catch(PDOException $e)
{
    echo"Connection failed" . $e->getMessage();
}
?>

当我实现这个 state 时，我很高兴，但我不知道对我来说最难的部分还没有被发现。 我已经尝试了至少 5 个小时来弄清楚如何进行密码散列，但我还没有成功。 以下代码是我尝试过的代码，因为有人告诉我它容易受到 SQL 注入的影响，所以我已经从 md5 散列转移了。

我试图像这样进行散列->

• dbcennect.php

<?php
    // POSTS
    $naam=isset($_POST['naam']) ? $_POST['naam'] : "";
    $email=isset($_POST['email']) ? $_POST['email'] : "";
    $tel=isset($_POST['tel']) ? $_POST['tel'] : "";
    $datum=isset($_POST['datum']) ? $_POST['datum'] : "";
    $tijd=isset($_POST['tijd']) ? $_POST['tijd'] : "";
    $hash = password_hash($email, PASSWORD_DEFAULT);                           // <--
    $secretPW = $hash;                                                         // <--

if(isset($_POST['submittedd'])){
    $dbhost = '127.0.0.1';
    $dbname = '2019inklok';
    $dbuser = 'root';
    $dbpass = '';

    // Attempts to connect to DB
    try {
        $conn = new PDO("mysql:host=$dbhost;dbname=$dbname", $dbuser, $dbpass);
        $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
        echo"Connected succesfully<br>";


    // Error msg if doesnt connect
    } catch(PDOException $e) {
        echo"Connection failed" . $e->getMessage();
    }

    // Sets all data inside database
    $pdoQuery = "INSERT INTO `clocktime`(`naam`, `email`, `tel`, `datum`, `tijd`) VALUES (:naam,:email,:tel,:datum,:tijd)";
    $pdoResult = $conn->prepare($pdoQuery);
    $pdoExec = $pdoResult->execute(array(":naam"=>$naam,":email"=>$hash,":tel"=>$tel,":datum"=>$datum,":tijd"=>$tijd,));  // <--

    if($pdoExec)
    {
        echo 'good job';
    }else{
        echo 'bad';
    }

    header("location: confirm.php");
}

global $secretPW;                                                                   // <--
?>

• login_handler.php

include_once ("../controller/db_cennection.php");
if(!isset($_SESSION)) 
{ 
    session_start(); 
} 

$dbhost = '127.0.0.1';
$dbname = '2019inklok';
$dbuser = 'root';
$dbpass = '';
$message = '';

// Attempts to connect to DB

try  
{  
     $connect = new PDO("mysql:host=$dbhost; dbname=$dbname", $dbuser, $dbpass);  
     $connect->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);  
     if(isset($_POST["login"]))  
     {  
 // THIS PART - doesnt work.
           $stmt = $connect->prepare("SELECT * FROM clocktime WHERE naam = :naam" );
           $stmt->execute(array(':naam' => $_POST['naam']));
           $row = $stmt->fetch(PDO::FETCH_ASSOC);

           if(count($row)>0) {
                if (password_verify($secretPW, $row['email'])) {
                     $_SESSION['sess_user_id']   = $row['ID'];
                     $_SESSION['sess_username'] = $row['naam'];
                     echo "home.php";
                } else {
                echo "invalid";
                }
           }
 // END OF THIS PART  

           if(empty($_POST["naam"]) || empty($_POST["email"]))  
           {  
                $message = '<label>All fields are required</label>';  
           }  
           else  
           {  
                $query = "SELECT * FROM clocktime WHERE naam = :naam AND email = :email";  
                $statement = $connect->prepare($query);  
                $statement->execute(  
                     array(  
                          'naam'     =>     $_POST["naam"],  
                          'email'     =>     $_POST["email"]  
                     )  
                );  


                $count = $statement->rowCount();  
                if($count > 0)  
                {  
                     $_SESSION["naam"] = $_POST["naam"];  
                     header("location:loggedin.php");  
                }  
                else  
                {  
                     $message = '<label>Wrong Data</label>';  
                }  
           }  
      }  

 }   // Error msg if doesnt connect
catch(PDOException $e)
{
    echo"Connection failed" . $e->getMessage();
}
?>

我希望有人可以帮助我让代码正常工作。 其用于教育目的。 如果有任何安全问题，我想知道我在哪里泄漏它们。