輸入哈希以重置密碼，而不是實際用戶密碼

Question

我有一個更新密碼頁面，該頁面不允許我在“當前密碼”字段中輸入實際的當前密碼。 相反，它需要哈希密碼。 但是，一旦更改，則對新的哈希進行哈希處理，這是一件好事。 我只需要能夠輸入實際的密碼而不是散列即可。

是的，我知道，沒有md5； 這更多的是測試。

changepassword.js

<script>
function validatePassword() {
var currentPassword,newPassword,confirmPassword,output = true;

currentPassword = document.frmChange.currentPassword;
newPassword = document.frmChange.newPassword;
confirmPassword = document.frmChange.confirmPassword;

if(!currentPassword.value) {
currentPassword.focus();
document.getElementById("currentPassword").innerHTML = "required";
output = false;
}
else if(!newPassword.value) {
newPassword.focus();
document.getElementById("newPassword").innerHTML = "required";
output = false;
}
else if(!confirmPassword.value) {
confirmPassword.focus();
document.getElementById("confirmPassword").innerHTML = "required";
output = false;
}
if(newPassword.value != confirmPassword.value) {
newPassword.value="";
confirmPassword.value="";
newPassword.focus();
document.getElementById("confirmPassword").innerHTML = "not same";
output = false;
}   
return output;
}
</script>   

updatepassword.php

<?php
    include 'core/login.php';    === this contains the connection, it's obviously good ===
    include 'includes/head.php';  === changepassword.js is linked in the head ===   
    if(count($_POST)>0) {
    $result = mysqli_query($link, "SELECT *from users WHERE id='" . $_SESSION["id"] . "'");
    $row = mysqli_fetch_array($result);
    if($_POST["currentPassword"] == $row["password"]) {
    mysqli_query($link, "UPDATE users set `password`='" .md5(md5($_POST['newPassword'])) . "' WHERE id='" . $_SESSION["id"] . "'");
    $message = "Password Changed";
    } else $errormessage = "Current Password is not correct";
    }
print_r($_SESSION);
?>

同一頁上的表格：

<div class="container">
            <div class="text-center">
                <h4>Change password below</h4>
            </div><br />

            <div class="message"><?php if(isset($message)) { echo $message; } ?></div>
            <div class="message"><?php if(isset($errormessage)) { echo $errormessage; } ?></div>

            <div class="col-md-4 col-md-offset-4">                                                      
                <form name="frmChange" method="post" action="" onSubmit="return validatePassword()">

                    <div class="form-group">
                        <label>Current Password*</label>  
                        <input type="text" name="currentPassword" class="form-control input-md" />
                    </div>
                    <div class="form-group">
                        <label>New Password*</label>  
                        <input type="text" name="newPassword" class="form-control input-md" />
                    </div>  
                    <div class="form-group">
                        <label>Confirm Password*</label>  
                        <input type="text" name="confirmPassword" class="form-control input-md" />
                    </div>                          
                    <br />                  
                    <div class="text-center"> 
                        <input type="submit" name="submit" class="btn btn-success" value="Submit" />        


                    </div>                                      
                </form>                 
            </div>
        </div>

Answer 1

您的問題在這里：

if($_POST["currentPassword"] == $row["password"]) {

您正在將哈希的實際文本版本（例如“ password”）與該密碼的哈希版本（例如“ 213y789hwuhui1dh”）進行比較。 評估結果為：

if("password" == "213y789hwuhui1dh") {

這顯然永遠是不准確的。 解決該問題所需要做的就是以與創建密碼時相同的方式對密碼進行哈希處理。 如果我正確理解您的代碼，則應為：

if(md5(md5($_POST["currentPassword"]))==$row["password"]) {

有關SQL注入的旁注

請注意，此代碼非常容易插入。 用戶所需要做的就是在“ currentPassword” POST值后加上'; SHOW DATABASE; '; SHOW DATABASE; 並且他們將無限制地訪問服務器的MySQL數據庫。 考慮學習使用MySQLi預處理語句。 它們易於理解，易於實施。

Answer 2

我太過分了。 您的其他問題已關閉。 Juuuuust會留在這里...我正在使用PHP版本PHP 5.2.0。

• http://php.net/manual/en/faq.passwords.php
• http://php.net/manual/en/function.password-hash.php
• http://php.net/manual/en/function.password-verify.php

<?php

// so I don't actually have to test form submission, too... 
$_POST['current_password'] = 'Tacotaco'; 
$_POST['new_password']     = 'NINrocksOMG';
$_POST['confirmPassword']  = 'NINrocksOMG'; 
$_SESSION['id'] = 1;

// this is Tacotaco encrypted... update your db to test
// update users set password = '$2y$10$fc48JbA0dQ5dBB8MmXjVqumph1bRB/4zBzKIFOVic9/tqoN7Ui59e' where id=1


// the following is sooooo ugly... don't leave it this way 

if (!isset($_SESSION['id'])            or empty($_SESSION['id']) or
    !isset($_POST['current_password']) or empty($_POST['current_password']) or 
    !isset($_POST['new_password'])     or empty($_POST['new_password']) or 
    !isset($_POST['confirmPassword'])  or empty($_POST['confirmPassword']) ) {
   $message = 'Please enter your password';
}
else {
   $sid = $_SESSION['id'];

   $currpass = $_POST['current_password'];
   $newpass  = $_POST['new_password'];
   $conpass  = $_POST['confirmPassword'];

   $message  = validate_password($sid, $currpass, $newpass, $conpass);
}

print "<br/>$message<br/>";

function validate_password($sid, $currpass, $newpass, $conpass) {
   $mysqli = mysqli_connect('localhost','root','','test')
               or die('Error ' . mysqli_error($link));

   $stmt = $mysqli->prepare('select id, password from users where id = ?');
   $stmt->bind_param("s", $sid);
   $stmt->execute();
   $stmt->bind_result($userid, $userpass);

   $message = '';

   if ($stmt->fetch()) { 
      $stmt->close(); 

      if (strlen($newpass) < 8) {
         $message = 'Please enter a password with at least 8 characters';
      }
      elseif (!preg_match('`[A-Z]`', $newpass)) {
         $message = 'Please enter at least 1 capital letter';
      }
      elseif ($newpass !== $conpass) { 
         $message = 'Your passwords do not match.';
      }
      else {  
         if (password_verify($currpass, $userpass)) {  
            $hashed_new = password_hash($newpass, PASSWORD_BCRYPT);  
            $query = 'update users set password = ? where id = ?'; 
            $stmt_new = $mysqli->prepare($query); 

            $stmt_new->bind_param('ss', $hashed_new, $sid);
            if ($stmt_new->execute()) {
               $message = 'Password Changed';
            }
            else {
               $message = $mysqli->error;
            }
         }
         else $message = 'Current Password is not correct';
      }
   }
   else {
      $message = 'user not found for id $sid';
   }

   $mysqli->close(); 
   return $message;
}
?>