用户身份验证密码哈希 [重复]

Question

好的，所以我正在尝试制作一个基本的用户身份验证系统。好吧，我已经做到了。但是我现在要做的是根据哈希检查用户密码。我正在使用 $hash = password_hash($password, PASSWORD_DEFAULT);但是对于登录页面，我想使用数据库中的哈希密码检查用户密码，以便他们可以登录。我该怎么做？

注册.php：

    <?php
include('config.php'); 

if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}

function mres($input){
    if (get_magic_quotes_gpc()){
        $input = stripslashes($input);
    }
    return mysqli_real_escape_string($conn, $_POST['$input']);
}

$email=mysqli_real_escape_string($conn, $_POST['email']);
$username=mysqli_real_escape_string($conn, $_POST['username']);
$password=mysqli_real_escape_string($conn, $_POST['password']);
$hash = password_hash($password, PASSWORD_DEFAULT);
$query = $conn->query("select * from users where username='$username'");
$rows = mysqli_num_rows($query);
if ($rows == 1) {
echo "User already exist redirecting in 5 seconds!";
} else {
$sql = "INSERT INTO users (username, password, email)
VALUES ('$username', '$hash', '$email')";
if ($conn->query($sql) === TRUE) {
echo "New record created successfully";
} else {
echo "Error: " . $sql . "<br>" . $conn->error;
}
}

$conn->close();
header("Location: ../index.php");
?>

登录.php：

<?php
session_start();
include('config.php'); 

$error=''; 

if (isset($_POST['submit'])) {
if (empty($_POST['userid']) || empty($_POST['passid'])) {
$error = "Username or Password is invalid";
}
else
{


$user=mysqli_real_escape_string($conn, $_POST['userid']);
$pass=mysqli_real_escape_string($conn, $_POST['passid']);
$hash = password_hash($pass, PASSWORD_DEFAULT);
$passv = password_verify($pass, $hash);
$query = $conn->query("select * from users where password='$passv' AND username='$user'");
$rows = mysqli_num_rows($query);
if ($rows == 1) {
$_SESSION['login_user']=$username;
$_SESSION['username']=$user;
$_SESSION['checklogin']== true;
header("location: ../profile.php"); 
} else {
$error = "Username or Password is invalid";
}
mysqli_close($conn);
}
}   
?>

（是的，我知道我在那里添加了那个我没有在寄存器中使用的函数。它以供将来使用，我现在保存它。我有计划。）

Answer 1

使用用户名从数据库中选择密码。从数据库中获取哈希密码，并在 if 语句中使用 password_verify(inputPassword,hashPassword)。