如何从 mysql DB 验证用户密码

Question

我从 mySQL DB 验证用户密码时遇到问题。 起初我散列我的密码并将其写入我的数据库：

首先我的注册处理程序：

class RegisterHandler
{
    /**
     * @var RegisterQuery
     * 
     */
    private $register;

    /**
     * @var HashPassword
     *
     */
    private $HashPassword;

    /**
     * @var string
     *
     */
    private $getUsername;

    /**
     * @var string
     *
     */
    private $username;

    public function __construct()
    {
        $this->username = $_POST['username'];
        $this->register = new RegisterQuery;
        $this->checkUsername = new SelectUsernameQuery;
        $this->HashPassword = new HashPassword($_POST['password']);
    }

    public function execute()
    {
        $hashedPassword = $this->HashPassword->getHashedPassword();
        $salt = $this->HashPassword->getSalt();

        $dbUser = $this->checkUsername->execute($this->username);
        $dbUser->bindValue( 1, $this->username);
        $dbUser->execute();

        if( !$dbUser->rowCount() == 0 ) { # If rows are found for query
            echo "Username found";
            return;
        }

        $this->register->execute($this->username, $hashedPassword, $salt, $_POST['name']);

    }
}

你可以看到我用这段代码在执行函数中散列了我的密码：（忘记盐我不再使用它了）

class HashPassword
{
    /**
     * @var string
     * 
     */
    private $salt = 'x';

    /**
     * @var string
     * 
     */
    private $hashedPassword;

    public function __construct($password)
    {
        $this->hashedPassword = password_hash($password, PASSWORD_BCRYPT, ['cost' => 12]);
        $this->getHashedPassword();
    }

    public function getHashedPassword()
    {
        return $this->hashedPassword;
    }
}

在对密码进行哈希处理后，我将哈希写入 de DB。

现在是我的问题： 如何从 DB 获取密码以进行验证？

我试过了：

class LoginHandler
{

    private $databaseWrapper;

    /**
     * @var SelectUsernameQuery
     * 
     */
    private $checkUsername;

    private $checkPassword;

    /**
     * @var string
     *
     */
    private $enteredUsername;

    /**
     * @var string
     *
     */
    private $enteredPassword;

    /**
     * @var HashPassword
     *
     */
    private $passwordHasher;

    public function __construct()
    {
        $this->databaseWrapper = new DatabaseWrapper;
        $this->checkUsername = new SelectUsernameQuery;
        $this->checkPassword = new SelectPasswordQuery;
        $this->enteredUsername = $_POST['username'];

        $this->passwordHasher = new HashPassword($this->enteredPassword);
    }

    private function createSessionName()
    {
        $_SESSION['name'] = $this->enteredUsername;
    }

    public function execute()
    {
        $this->verifyUser();
    }

    private function verifyUser()
    {
        $this->enteredPassword = $_POST['password'];
        $userDBHash = $this->checkPassword->execute($this->enteredUsername);
        $userDBHash->execute();
        if(password_verify($this->enteredPassword, $userDBHash))
        {
            echo 'password is valid';
        }

        $dbUsername = $this->checkUsername->execute($this->enteredUsername);
        $dbUsername->bindValue( 1, $this->enteredUsername);
        $dbUsername->execute();

        if( !$dbUsername->rowCount() == 0 ) { # If rows are found for query
            echo 'Username: '."$this->enteredUsername".' was found!';
            $this->createSessionName();
            return;
        }

        echo 'Ups, This Username: '."$this->enteredUsername".' was not found!';    }
    }
}

在 verifyUser 类中，我将输入的密码写入变量 之后，我使用此查询从 $userDBHash 中的 DB 获取哈希：

private function getUsername($username)
{
    return $this->databaseWrapper->getPDO()->prepare(
           "SELECT password FROM users WHERE username = '$username'");
}

之后我尝试password_verify($this->enteredPassword, $userDBHash) 但我收到以下错误：

Warning: password_verify() expects parameter 2 to be string, object given in /var/www/c2b/src/Handlers/LoginHandler.php on line 72

Answer 1

您的问题似乎是，如何从数据库中获取密码哈希。我在脑海中做了一个简单的例子（未经测试），但它应该能让你开始。

private function getPasswordHashFromDatabase($username)
{
  $pdo = $this->databaseWrapper->getPDO();
  $stmt = $pdo->prepare('SELECT password FROM users WHERE username = ?');
  $stmt->bindParam(1, $username);
  if ($stmt->execute())
  {
    if ($row = $stmt->fetch())
    {
      return $row[0];
    }
  }
  return '';
}

注意 select 语句中的 ?，使用准备好的语句可以保护您的应用程序免受 SQL 注入。