哈希密码登录错误

Question

好吧，所以当我定义变量'$ password'是什么时，我使用'sha1'来散列我的密码，然后在登录阶段，我再次使用'sha1'但是我的错误消息登录凭证无效是唯一发生的事情。

registration.php的

$password = sha1($_POST['password']); 
    $password_escaped = mysqli_real_escape_string ($db, $password); 
    $query = "INSERT INTO admin (forename,surname,email,securityq, securitya,password) VALUES ('$forename_escaped','$surname_escaped','$email_escaped','$securityq_escaped','$securitya_escaped','$password_escaped')"; 

的login.php

if (!empty($_POST['email'])) 
{ 
    $email = $_POST['email']; 
    $password = sha1 ($_POST['pass']); 
    include('connect-db.php'); 
    $query = mysqli_query ($db, "SELECT * FROM admin WHERE email = '$email' AND password = '$password'"); 

$row = mysqli_fetch_array ($query); 
if(!empty($row['email']) AND !empty($row['password'])) 
{ 
    $_SESSION['email'] = $row['password']; 

成功或失败的消息

echo ("<SCRIPT LANGUAGE='JavaScript'> 
    window.alert('Successful Login') 
    window.location.href='adminhome.php'; 
    </SCRIPT>"); 
} 
else 
{ 
echo ("<SCRIPT LANGUAGE='JavaScript'> 
    window.alert('Invalid Login Credentials') 
    window.location.href='adminsignin.php'; 
    </SCRIPT>"); 
} 

} 
} 

if(isset($_POST['submit'])) 
{ 
SignIn(); 
} 

这个代码有什么问题，它不会让我用哈希密码登录？

Answer 1

打印我的$查询以查看与数据库相比获得什么密码并检查数据库中的散列密码后，我意识到数据库中的密码有10个字符丢失，我意识到我的VARCHAR设置为30 ...和密码哈希是40！

设置VARCHAR（40）后，密码哈希值立即生效。

任何与我有类似问题的人（愚蠢）都要确保您的数据库中的值足够长。

Answer 2

你的代码有几个缺陷，并有一些解决它的可能性。

快速和脏解决是将线

if (!empty($_POST['email'])) 
{ 
    $email = $_POST['email']; 
    $password = ($_POST['pass']); 

更改为

if (!empty($_POST['email'])) 
{ 
    $email = $_POST['email']; 
    $password = sha1($_POST['pass']); //you need to check the hashes not the password itself. 

更清洁的修复将是使用password_hash（见here）。

您的代码会比是：

要使用的mysqli分贝

$myslqiDB = new mysqli("localhost", "my_user", "my_password", "world"); 

要注册

$email = $myslqiDB->real_escape_string($_POST['email']); 
$options = [ 
    'cost' => 12, 
]; 
$password = $myslqiDB->real_escape_string(password_hash ($_POST['password'],PASSWORD_BCRYPT, $options)); 

$query = "INSERT INTO admin (forename,surname,email,securityq, securitya,password) VALUES ('$forename','$surname','$email','$securityq','$securitya','$password')"; 

$data = $myslqiDB->query ($query)or die($myslqiDB->error()); 

登陆

if (!empty($_POST['email'])) 
{ 
    $email = $myslqiDB->real_escape_string($_POST['email']); 
    $password = $_POST['pass']; 
    $query = $myslqiDB->query ("SELECT * FROM admin WHERE email = '$email'"); 

    $row = $myslqiDB->fetch_assoc ($query); 
    if(!empty($row['email']) AND !empty($row['password'])) 
    { 
     if (password_verify ($password , $row['password'])){ 
      //loggedin 
     }else{ 
      //wrong password. 
     } 
    }else{ 
     //no user with this email 
    }