如何使用 Wordpress salt 在 Wordpress 中加密密码？

Question

我想使用标准的 Wordpress salt 对发送到数据库的密码进行加密，就像 Wordpress 在创建新用户时所做的那样。我知道我可以在 wp-config.php 中找到我的盐。所以我不需要生成盐；我只需要加密密码。

因此，当我创建 mypassword0 时，发送到数据库的是由我的 Wordpress salt 加密的文本字符串。

这是我的原始代码。 （感谢Yadav Chetan的帮助！）现在我只需要添加盐加密代码。

  <?php
        if(isset($_POST['submit'])){

        $query = "INSERT INTO mytable_one
          (user, pass)
          VALUES
          ('".$_POST['user']."', '".$_POST['pass']."')";

        $query = "INSERT INTO mytable_two
          (fname, lname)
          VALUES
          ('".$_POST['fname']."', '".$_POST['lname']."')";

        mysql_query($query);

         }else{
    ?>
    <div class="content">
        <form method="post">
            <div><strong>First Name:</strong><span class="errortext">*</span></div>
            <div><input id="first-name" name="fname" type="text" /></div>

            <div><strong>Last Name:</strong><span class="errortext">*</span></div>
            <div><input id="last-name" name="lname" type="text" /></div>

            <div><strong>User:</strong><span class="errortext">*</span></div>
            <div><input id="user-login" name="user" type="text" /></div>

            <div><strong>Password:</strong><span class="errortext">*</span></div>
            <div><input id="user-pass" name="pass" type="text" /></div>

            <div><input id="submit-button" value="submit" type="submit" />
        </div>          
        </form>
    <?php }?>

---

更新：

RRikesh 建议我将 mysql_* 更改为 WPDB 代码。所以我尝试将其更改为 wpdb，并且我需要将其与其他代码集成。那么你能帮我修复这个更新的代码吗？

<?php
    if(isset($_POST['submit'])){


    $firstname = $_POST['fname'];
    $lastname = $_POST['lname'];
    $username = $_POST['user'];
    $password = $_POST['pass'];

    $wpdb->query( 
        $wpdb->prepare( 
           "INSERT INTO  mytable_one
          (user, pass) VALUES (%s, %s)",
             $username,
             wp_hash_password($password)
      )
    );
    $wpdb->query( 
        $wpdb->prepare( 
            "INSERT INTO  mytable_two
            (fname, lname) VALUES (%s, %s)",
               $firstname,
               $lastname,
        )
    );

    }else{
?>
<div class="content">
    <form method="post">
                <div><strong>First Name:</strong><span class="errortext">*</span></div>
                <div><input id="first-name" name="fname" type="text" /></div>

                <div><strong>Last Name:</strong><span class="errortext">*</span></div>
                <div><input id="last-name" name="lname" type="text" /></div>

                <div><strong>Username:</strong><span class="errortext">*</span></div>
                <div><input id="user-login" name="user" type="text" /></div>

                <div>Password:</div>
                <div><input id="user-pass" name="pass" type="text" /></div>

        <div><input id="submit-button" value="submit" name="submit" type="submit" /></div>          
    </form>
<?php }?>

---

---

更新2

我无法让 WPDB 方法工作。但是，使用我的 otd 方法，我能够获得密码。这是工作代码：

    <?php
        if(isset($_POST['submit'])){

            $password = $_POST['user_pass'];
            $hash = wp_hash_password('$password');

            $query = "INSERT INTO wp_users
              (fname, lname, user, pass) VALUES ('".$_POST['fname']."', '".$_POST['lname']."', '".$_POST['user']."', '".$hash."')";

            mysql_query($query);

        }else{
    ?>

也许我应该提出一个关于 WPDB 的新问题，因为这个问题是关于对密码进行哈希处理的，这个问题已经解决了。

Answer 1

使用wp_hash_password() 对您的密码进行哈希处理。

Don't use mysql_* functions as they were deprecated in PHP 5.5.0, and were removed in PHP 7.0.0.

请改用WPDB Class。

$wpdb->query( 
    $wpdb->prepare( 
        "
        INSERT INTO  mytable_one
        ( fname, lname, user, pass )
        VALUES ( %s, %s, %s, %s )
        ",
           $firstname,
           $lastname,
           $username,
           wp_hash_password( $password )
        )
);

Answer 2

你应该使用 bcrypt 来保护密码

这是一个用于我的项目的示例类。

<?php

    // How to use it

    // $bcrypt = new Bcrypt(15);
    // $hash = $bcrypt->hash('password');
    // $isGood = $bcrypt->verify('password', $hash);

    class Bcrypt {
      private $rounds;
      public function __construct($rounds = 12) {
        if(CRYPT_BLOWFISH != 1) {
          throw new Exception("bcrypt not supported in this installation. See http://php.net/crypt");
        }

        $this->rounds = $rounds;
      }

      public function hash($input) {
        $hash = crypt($input, $this->getSalt());

        if(strlen($hash) > 13)
          return $hash;

        return false;
      }

      public function verify($input, $existingHash) {
        $hash = crypt($input, $existingHash);

        return $hash === $existingHash;
      }

      private function getSalt() {
        $salt = sprintf('$2a$%02d$', $this->rounds);

        $bytes = $this->getRandomBytes(16);

        $salt .= $this->encodeBytes($bytes);

        return $salt;
      }

      private $randomState;
      private function getRandomBytes($count) {
        $bytes = '';

        if(function_exists('openssl_random_pseudo_bytes') &&
            (strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN')) { // OpenSSL slow on Win
          $bytes = openssl_random_pseudo_bytes($count);
        }

        if($bytes === '' && is_readable('/dev/urandom') &&
           ($hRand = @fopen('/dev/urandom', 'rb')) !== FALSE) {
          $bytes = fread($hRand, $count);
          fclose($hRand);
        }

        if(strlen($bytes) < $count) {
          $bytes = '';

          if($this->randomState === null) {
            $this->randomState = microtime();
            if(function_exists('getmypid')) {
              $this->randomState .= getmypid();
            }
          }

          for($i = 0; $i < $count; $i += 16) {
            $this->randomState = md5(microtime() . $this->randomState);

            if (PHP_VERSION >= '5') {
              $bytes .= md5($this->randomState, true);
            } else {
              $bytes .= pack('H*', md5($this->randomState));
            }
          }

          $bytes = substr($bytes, 0, $count);
        }

        return $bytes;
      }

      private function encodeBytes($input) {
        // The following is code from the PHP Password Hashing Framework
        $itoa64 = './ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';

        $output = '';
        $i = 0;
        do {
          $c1 = ord($input[$i++]);
          $output .= $itoa64[$c1 >> 2];
          $c1 = ($c1 & 0x03) << 4;
          if ($i >= 16) {
            $output .= $itoa64[$c1];
            break;
          }

          $c2 = ord($input[$i++]);
          $c1 |= $c2 >> 4;
          $output .= $itoa64[$c1];
          $c1 = ($c2 & 0x0f) << 2;

          $c2 = ord($input[$i++]);
          $c1 |= $c2 >> 6;
          $output .= $itoa64[$c1];
          $output .= $itoa64[$c2 & 0x3f];
        } while (1);

        return $output;
      }
    }



    ?>