如何使用 password_hash 更改密码？

Question

我尝试在用户输入密码时将这个 php 代码更改为 password_hash，如果他想更改它，但它永远不会匹配，因为存储在我的数据库中的 pssword 在注册期间被散列，所以我需要旧的 pw他输入的内容与 db 上不起作用的散列密码相匹配。

我知道我应该使用 password_verify 但我不知道我应该插入这段代码的哪一部分？

<?php
  include 'session.php';
  $db = new mysqli('localhost', 'root', '', 'alumni');
  if(isset($_POST['submit'])):
  extract($_POST);


  $user_check=$_SESSION['login_user'];

  $old_pwd=$_POST['old_password'];
  $pwd=$_POST['password'];
  $c_pwd=$_POST['confirm_pwd'];
  if($old_pwd!="" && $pwd!="" && $c_pwd!="") :


  if($pwd == $c_pwd) :
  if($pwd!=$old_pwd) :
    $sql="SELECT * FROM `alumni` WHERE `username`='$user_check' AND `password` ='$old_pwd'";
    $db_check=$db->query($sql);
    $count=mysqli_num_rows($db_check);
  if($count==1) :
    $fetch=$db->query("UPDATE `alumni` SET `password` = '$pwd' WHERE `username`='$user_check'");
    $old_pwd=''; $pwd =''; $c_pwd = '';
    $msg_sucess = "Password successfully updated!";
  else:
    $error = "Old password is incorrect. Please try again.";
  endif;
  else :
    $error = "Old password and new password are the same. Please try again.";
  endif;
  else:
    $error = "New password and confirm password do not match.";
  endif;
  else :
    $error = "Please fill all the fields";
  endif;   
  endif;
?> 

Answer 1

我终于让它工作了！非常感谢您的帮助，尤其是肖恩爵士！ :D

我改变了这个：

 $sql="SELECT * FROM `alumni` WHERE `username`='$user_check' AND `password` ='$old_pwd'";
$db_check=$db->query($sql);
$count=mysqli_num_rows($db_check);

if($count==1) :
    $fetch=$db->query("UPDATE `alumni` SET `password` = '$pwd' WHERE `username`='$user_check'");

到这里：

 $sql=("SELECT * FROM alumni WHERE username='$user_check'");
 $db_check=$db->query($sql);
 if(password_verify($old_pwd,$db_check->fetch_assoc()['password'])):
$fetch=$db->query("UPDATE `alumni` SET `password` = '$new_pw' WHERE username`='$user_check'");

是的，我添加了一个新变量 $new_pw

$new_pw = password_hash($c_pwd, PASSWORD_DEFAULT);

如果你们认为我做错了，请随时发表评论。谢谢你:)

Answer 2

试试这个

<?php
  include 'session.php';
  session_start();
  $db = new mysqli('localhost', 'root', '', 'alumni');
  if(isset($_POST['submit'])):
  extract($_POST);


  $user_check=$_SESSION['login_user'];

  $old_pwd=$_POST['old_password'];
  $pwd=$_POST['password'];
  $c_pwd=$_POST['confirm_pwd'];
  if($old_pwd!="" && $pwd!="" && $c_pwd!="") :


  if($pwd == $c_pwd) :
  if($pwd!=$old_pwd) :
    $sql="SELECT * FROM `alumni` WHERE `username`='$user_check' AND `password` =PASSWORD($old_pwd)";
    $db_check=$db->query($sql);
    $count=mysqli_num_rows($db_check);
  if($count==1) :
    $fetch=$db->query("UPDATE `alumni` SET `password` = PASSWORD($pwd) WHERE `username`='$user_check'");
    $old_pwd=''; $pwd =''; $c_pwd = '';
    $msg_sucess = "Password successfully updated!";
  else:
    $error = "Old password is incorrect. Please try again.";
  endif;
  else :
    $error = "Old password and new password are the same. Please try again.";
  endif;
  else:
    $error = "New password and confirm password do not match.";
  endif;
  else :
    $error = "Please fill all the fields";
  endif;   
  endif;
?>