散列密码不匹配

我创建了一个注册和一个登录脚本，它使用完全相同的方式对密码进行散列，但是当用户尝试使用密码登录时，散列登录密码和存储在数据库中的密码不同，它在几天前工作，我没有改变任何登录和注册脚本。散列密码不匹配

这里是存储的凭据是什么

DBEMAIL：[email protected]

DBPASSWORD： addb18f27b6970082727069aa5853116223c5ab46f46a7b07340757804670aef61311ff0254ec45ea78d9ea6d8afb2cefdf3afd6bd4947f6fc558f46703fac1c

下面是用户插入的凭据：

UEMAIL：[email protected]

UPASSWORD：4123363f30664825356a238fe7a568910315e6f6aa8a57d0264844c641e856ab207200f4c75a532b2ebecdbd062bff31da101d973ab0f83eaefd2323a39a4a88

他们使用散列：

$salt = "salinger"; 
$hashed = hash_hmac("sha512", $password, $salt);

完整的注册功能（这是凌乱的，但我知道它的工作原理（直到现在）：

function registerUser($firstname, $surname, $email, $password, $secretQ, $secretA, $address, $city, $postcode) { 
    $flag = array(); 
    $validEmail = validateEmail($email); 
    if (($validEmail) == true) { 
     //Do not flag 
    } else { 
     array_push($flag, 1); 
    } 
    if ((textOnly("First name", $firstname) == true) || ((textOnly("Surname", $surname)) == true) || ((textOnly("City", $city)) == true)) { 
     array_push($flag, 1); 
    } 
    if ((emptyField($firstname)) || (emptyField($surname)) || (emptyField($email)) || (emptyField($password)) || (emptyField($secretA)) || (emptyField($address)) || (emptyField($city)) || (emptyField($postcode))) { 
     array_push($flag, 1); 
    } 
    if (validPostcode($postcode) == false) { 
     array_push($flag, 1); 
    } 
    if (duplicateEmail($email) == true) { 
     array_push($flag, 1); 
    } 
    if (validatePassword($password) == false) { 
     array_push($flag, 1); 
    } else { 
     $password = validatePassword($password); 
    } 
    switch ($secretQ) { 
     case 1: 
      $secretQ = "Your mothers maiden name?"; 
      break; 
     case 2: 
      $secretQ = "Name of your first pet?"; 
      break; 
     case 3: 
      $secretQ = "The name of your high school?"; 
      break; 
     case 4: 
      $secretQ = "Your favourite instrument?"; 
      break; 
    } 

    $salt = "salinger"; 
    $hashed = hash_hmac("sha512", $password, $salt); 

    if (!empty($flag)) { 
     echo "There are errors with your registration, go back and ammend it. <br /> <a href=\"register.php\">&lt;&lt; Back</a>"; 
    } else { 
     if ((isset($firstname)) && (isset($surname)) && (isset($email)) && (isset($password)) && (isset($secretQ)) && (isset($secretA)) && (isset($address)) && (isset($city)) && (isset($postcode))) { 
      $sql = "INSERT INTO customer (forename, surname, email, password, secretQ, secretA, address_street, address_city, address_postcode, member_type) VALUES ('$firstname', '$surname', '$email', '$hashed', '$secretQ', '$secretA', '$address', '$city', '$postcode', 'User');"; 
      header("Location: index.php"); 
     } else { 
      array_push($flag, 1); 
     } 
    } 
    $result = mysql_query($sql); 
    if (!$result) { 
     die(mysql_error()); 
    } 
}

登录功能：

function loginUser($email, $password) { 
    if (validateEmail($email) == true) { 
     $sql = "SELECT customerid, forename, email, password, secretA, member_type FROM customer WHERE email = '$email'"; 

     $result = mysql_query($sql); 

     while ($record = mysql_fetch_array($result)) { 
      $DBid  = $record['customerid']; 
      $DBemail = $record['email']; 
      $DBpassword = $record['password']; 
      $DBforename = $record['forename']; 
      $DBsecretA = $record['secretA']; 
      $DBmember = $record['member_type']; 
     } 

     if (!$result) { 
      die(mysql_error()); 
     } 

     $salt = "salinger"; 
     $hashed = hash_hmac("sha512", $password, $salt); 

     echo "DBEMAIL: $DBemail DBPASSWORD: $DBpassword <br/>"; 
     echo "UEMAIL: $email UPASSWORD: $hashed <br/>"; 

     if (($email == $DBemail) && ($hashed == $DBpassword)) { 
      $match = true; 
     } else { 
      $match = false; 
     } 

     if ($match == true) { 
      session_start(); 
      $_SESSION['userid'] = $DBid; 
      $_SESSION['Active'] = true; 
      $_SESSION['forename'] = $DBforename; 
      $_SESSION['type']  = $DBmember; 
      header("Location: member.php"); 
     } else { 
      echo "Incorrect credentials."; 
     } 
    } else { 
     echo "Invalid email address!"; 
    } 
return true; 
}

来源

2012-12-11 ZeroBased_IX

如果调用'hash_hmac（）'不再产生相同的输出，我不认为休息的代码是相关的。您的主机最近是否升级到较新的PHP版本，如5.4？ –

告诉我们你从哪里调用'registerUser'的代码？ – GBD

您在MySQL中为密码字段分配了多少个字符？您可能正在存储截断的散列。 –

在registerUser中，我会仔细看看这个：

... 
if (validatePassword($password) == false) { 
    array_push($flag, 1); 
} else { 
    $password = validatePassword($password); 
} 
...

$password将被覆盖，它会显示，如果它是一个有效的密码。如果数据库中的所有密码都相同，那么可能是$密码设置为true，这就是腌制的值。这取决于你如何使用validatePassword，你可以删除else从句，离开这个：

... 
if (validatePassword($password) == false) { 
    array_push($flag, 1); 
} 
...

来源

2012-12-11 17:06:44

我其实只是面对面，我不能相信我错过了这一点。非常感谢，完美的作品。 –

我很高兴它的工作原理！没有忧虑，发生在每个人身上 –

散列密码不匹配

回答

相关问题