函数 password_verify() 在应该返回 true 时返回 false

Question

我正在为学校的比赛创建一个项目。我已经正确完成了注册部分。当涉及到登录部分时，我无法正确完成。我尝试在许多其他问题上查找问题网站，但找不到它。即使我在函数中输入密码，函数也会返回 false。

我尝试使用 password_BCRYPT 进行散列，我从 $_POST['password'] 获得的密码，然后使用 hash_equals() 与数据库中的密码进行比较，但它不起作用

这是 login.php 编辑：我忘了添加 register.php 和 file_db.php.Sorry！

<?php
require "file_db.php";
$email= $mysqli->escape_string($_POST['email']);
echo $_POST['email'];
$result= $mysqli->query("SELECT *FROM users WHERE email='$email'");
if($result->num_rows == 0) {
    $SESSION['message']="Nu exista niciun utilizator cu acel email";
    header("location:error.php");
} else {
    $user=$result->fetch_assoc();
    $hash=substr($user['password'],0,60);
    if(password_verify($_POST['password'],$hash)) {
        $_SESSION['email']=$user['email'];
        $_SESSION['firstname']=$user['firstname'];
        $_SESSION['lastname']=$user['lastname'];
        $_SESSION['active']=$user['active'];
        $_SESSION['loggedin']=true;
        echo $_SESSION['loggedin'];
        echo 1;
    } else{
        $_SESSION['message']="Ai introdus o parola gresita!";
    }
}
?>

<?php
require "file_db.php";

$firstname = $mysqli->escape_string($_POST['firstname']);
$lastname = $mysqli->escape_string($_POST['lastname']);
$email = $mysqli->escape_string($_POST['email']);
$password =$mysqli->escape_string(password_hash($_POST['password'],PASSWORD_BCRYPT));
$hash = $mysqli->escape_string(md5(rand(0,1000) ) );

$_SESSION['email']=$_POST['email'];
$_SESSION['firstname']=$_POST['firstname'];
$_SESSION['lastname']=$_POST['lastname'];

$result = $mysqli->query("SELECT * FROM users WHERE email ='$email' ") or die($mysqli->error());

if($result->num_rows > 0)
{
    $_SESSION['message']='Exista un utilizator cu acest email deja!';
    header("location:error.php");
}
else{
    $sql="INSERT INTO users (firstname,lastname,email,password,hash)".
        "VALUES('$firstname','$lastname','$email','$password','$hash')";
    if( $mysqli->query($sql) )
    {
        $_SESSION['active']=0;
        $_SESSION['message']="Link  de confirmare a fost trimis la $email, te rugam sa iti verifici contul accesand link-ul trimis in email!";

        $to = $email;
        $subject='Account Verification';
        $messageb='
        Salut'.$firstname.',
        Multumim pentru ca te-ai inscris!
        Apasa pe acest link pentru a-ti activa contul:
        https://localhost/aWEBDEVFII/verify.php?email='.$email.'&hash'.$hash;
        mail($to, $subject, $messageb);

        header("location:success.php");
    }
    else{
        $_SESSION['message']='Inregistrarea a intampinat o eroare!';
        header("location: error.php");
    }
}
?>
``````




<?php
session_start();
$host='localhost';
$user='root';
$pass='';
$db='filesdb';
$mysqli= new mysqli($host,$user,$pass,$db) or die($mysqli->error);
?>

Answer 1

首先你为什么要将substr()函数应用于哈希密码

substr() 函数用于从字符串中截取字符串的一部分，从指定位置等开始。

如果你想检查输入密码的长度，你应该使用strlen() 如果密码长度超过 60，则向用户返回一条消息

if (strlen($password)<60) {
  echo "less than 60";
}
else
if (strlen($password)>40) {
  echo "more than 60";
}
else {
  echo "exactly 60";
}

为了能够使用password_verify()，您应该能够在注册期间首先对用户密码进行哈希处理 通过password_hash() 函数。例如。

 $password ='nancymore12344444';
 $options = array("cost"=>4);
 $hashPassword = password_hash($password,PASSWORD_BCRYPT,$options);

再次，它们将成为您的登录脚本中的一个问题，因为我没有看到您是否通过 session_start() 初始化会话

尝试下面的代码，同时确保数据库凭据和所有表列都到位。你会没事的

所以你的注册 php 看起来像

<?php
//require "file_db.php"; 
$conn = mysqli_connect("localhost","root","","demo");

if(!$conn){
    die("Connection error: " . mysqli_connect_error()); 
}

if(isset($_POST['submit'])){
        $firstName = mysqli_real_escape_string($conn,$_POST['first_name']);
        $surName = mysqli_real_escape_string($conn,$_POST['surname']);
        $email  = mysqli_real_escape_string($conn,$_POST['email']);
        $password = mysqli_real_escape_string($conn,$_POST['password']);

        $options = array("cost"=>4);
        $hashPassword = password_hash($password,PASSWORD_BCRYPT,$options);

        $sql = "insert into users (first_name, last_name,email, password) value('".$firstName."', '".$surName."', '".$email."','".$hashPassword."')";
        $result = mysqli_query($conn, $sql);
        if($result)
        {
            echo "Registration successfully";
        }
    }
?>

您的登录名

<?php 
//require "file_db.php";
$conn = mysqli_connect("localhost","root","","demo");

if(!$conn){
    die("Connection error: " . mysqli_connect_error()); 
}
if(isset($_POST['submit'])){
    $email = mysqli_real_escape_string($conn,$_POST['email']);
    $password = mysqli_real_escape_string($conn,$_POST['password']);

    $sql = "select * from users where email = '".$email."'";
    $rs = mysqli_query($conn,$sql);
    $numRows = mysqli_num_rows($rs);

    if($numRows  == 1){
        $row = mysqli_fetch_assoc($rs);
        if(password_verify($password,$row['password'])){
            echo "Password verified and ok";

// initialize session if things where ok.


session_start();
session_regenerate_id();

$_SESSION['surname'] = $row['surname'];
$_SESSION['first_name'] = $row['first_name'];
$_SESSION['email'] = $row['email'];

// take me to welcome.php page
header('Location: welcome.php');

        }
        else{
            echo "Wrong Password details";
        }
    }
    else{
        echo "User does not exist";
    }
}

?>