如何在我的代碼中使用密碼驗證來更正錯誤

Question

我正在嘗試登錄表單。 但每次我嘗試登錄時，總會給出一條錯誤消息，指出我的密碼不正確。 我使用md5在數據庫中哈希我的密碼。

我試圖將hash和password_verify刪除到我的代碼，但它會自動以不正確的passowrd登錄用戶

<?php

if (isset($_POST['login-submit'])) {

require 'dbh.inc.php';

$mailuid = $_POST['mailuid'];
$password = $_POST['pwd'];

if (empty($mailuid) || empty($password)){
    header("Location: ../systemlogintut/index1.php?error=emptyfields");
    exit(); 
}
else {
    $sql = "SELECT * FROM users WHERE uidUsers=? OR emailUsers=?;";
    $stmt = mysqli_stmt_init($conn);
    if (!mysqli_stmt_prepare($stmt, $sql)) {
        header("Location: ../systemlogintut/index1.php?error=sqlerror");
    exit(); 
    }
    else {

        mysqli_stmt_bind_param($stmt, "ss", $mailuid, $password);
        mysqli_stmt_execute($stmt);
        $result = mysqli_stmt_get_result($stmt);
        if ($row = mysqli_fetch_assoc($result)) {
            $pwdCheck = password_verify($password, $row['pwdUsers']);
            if ($pwdCheck == false) {
            header("Location: ../systemlogintut/index1.php?error=wrongpwd");
            exit();     
            }
            else if ($pwdCheck == true) {
                session_start();
                $_SERVER['userId'] = $row['idUsers'];
                $_SERVER['userUid'] = $row['uidUsers'];
                header("Location: ../systemlogintut/index1.php?login=success");
            exit();
            }
            else {
            header("Location: ../systemlogintut/index1.php?error=wrongpwd");
            exit();
            }
        }
        else {
            header("Location: ../systemlogintut/index1.php?error=nouser");
            exit(); 
        }
    }
  }
}
else {
  header("Location: ../systemlogintut/index1.php");
  exit();
}

Answer 1

您將自動登錄用戶，更改此行中的重定向代碼

if ($row = mysqli_fetch_assoc($result)) 
{
   $pwdCheck = password_verify($password, $row['pwdUsers']);
     if ($pwdCheck == false) {
        header("Location: ../systemlogintut/index1.php?error=wrongpwd"); // change the redirection here
     exit();     
}

Answer 2

我只是將它改為：

$hashedPwd = password_hash($password, PASSWORD_DEFAULT);

而不是使用：

$hashedPwd = mb5($password, PASSWORD_DEFAULT);

Answer 3

試試吧$ password = md5（$ _ POST ['pwd']）;