如何验证哈希密码？

Question

我正在使用CodeIgniter框架。 下面是Signup.php控制器中包含的功能。

public function _hash_string($str){ 
      $hashed_string = password_hash($str, PASSWORD_BCRYPT); 
      return $hashed_string; 
     } 

     public function _verify_hash($text, $hashed_string){ 
      $result = password_verify($text, $hashed_string); 
      return result; //TRUE OR FALSE 
     } 

     public function index() 
     { 
      if($this->input->post('newuser') == 1) 
      { 
       $user = new Users_model(); 
       $user->username = $this->input->post('username'); 
       $user->email = $this->input->post('email'); 
       $pass= $this->input->post('password'); 
       $hashed_pass = $this ->_hash_string($pass); 
       $user->password = $hashed_pass; 
       $user->account_status = 1; 
       $user->user_role = $this->input->post('user_role'); 
       $id = $this->usermodel->insert($user); 
}else{ 
      $this->load->view('signup-page'); 
     } 

我已经成功地散列了用户的密码。我如何验证它们？ 以下是Login.php控制器中包含的功能。

public function index() 
    { 
     if($this->input->post('login') == 1) 
     { 
      $user = new Users_model(); 
      $user->email = $this->input->post('email'); 
      $user->password = $this->input->post('password'); 
      $user->user_role = $this->input->post('user_role'); 
      $results = $this->usermodel->login($user); 
      if(count($results) > 0) 
      { 
       foreach($results as $row) 
       { 
        $session_array = array(
         "id" => $row['id'], 
         "username" => $row['username'], 
         "email" => $row['email'], 
         "password" => $row['password'], 
         "account_status" => $row['account_status'], 
         "user_role" => $row['user_role'] 
        ); 
        $this->session->set_userdata($session_array); 
        $url = base_url() . "home?login=success"; 
        redirect($url, "refresh"); 
       } 
      }else{ 
       $url = base_url() . "login?login=failed"; 
       redirect($url, "refresh"); 
      } 
     }else{ 
      $this->load->view('login-page'); 
     } 
    } 

这里是Users_model.php模型。

function login($user){ 
     $conditions = array(
        "email" => $user->email, 
        "password" => $user->password, 
        "user_role" => $user->user_role, 
        "account_status" => 1, 
       ); 
     $this->db->select('*'); 
     $this->db->from('users'); 
     $this->db->where($conditions); 
     $rs= $this->db->get(); 
     return $rs->result_array(); 
    } 

我该如何正确地登录用户？

Answer 1

你不能在mysql中比较密码。因为使用php进行散列，你必须使用php函数来比较密码。

function login($user){ 
    $conditions = array(
       "email" => $user->email, 
       //"password" => $user->password, 
       "user_role" => $user->user_role, 
       "account_status" => 1, 
      ); 
    $this->db->select('*'); 
    $this->db->from('users'); 
    $this->db->where($conditions); 
    $rs= $this->db->get(); 
    if(!empty($rs)) { 
     $result_array = $rs->row_array(); 
     $controllerInstance = & get_instance(); 
if($controllerInstance->_verify_hash($user->password,$result_array['password']) == TRUE) { 
     return $result_array; 
     } 
    } 
    return false; 
} 

使用get实例访问控制器。 $ controllerInstance = & get_instance（）; $ controllerData = $ controllerInstance - > _ verify_hash（）;

希望这会有所帮助。 zaph评论后更新