【发布时间】：2011-12-02 22:43:35
【问题描述】：
可能重复：
forget password page, creating a generated password to email to the user.
我正在尝试创建更改密码页面。下面的代码应检查以确保用户在数据库中，确认当前密码并允许他们更改密码。它会正确验证他们的新密码，以确保它们相同且具有一定的长度，但如果用户名不在数据库中，它不会返回错误消息，并且它表示当前密码是在数据库错误。我认为它没有正确匹配哈希密码，但我不确定。谁能帮我解决这些问题。谢谢。
<!--
To change this template, choose Tools | Templates
and open the template in the editor.
-->
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Change Password Confrim</title>
</head>
<body>
<?php
$db_server = "server";
$db_username = "name";
$db_password = "pass";
$con = mysql_connect($db_server, $db_username, $db_password);if (!$con)
{
die('Could not connect: ' . mysql_error());
}
$database = "User";
$er = mysql_select_db($db_username);
if (!$er)
{
print ("Error - Could not select the database");
exit;
}
//////////Collect the form data ////////////////////
$username =$_P0ST['username'];
$cur_password=$_POST['cur_password'];
$password=$_POST['password'];
$password2=$_POST['password2'];
/////////////////////////
$password = mysql_real_escape_string($password);
$password2 = mysql_real_escape_string($password2);
$username = mysql_real_escape_string($username);
$cur_password = mysql_real_escape_string($cur_password);
//Setting flags for checking
$status = "OK";
$msg="";
//Checking to see if password is at least 3 char max 8
if ( strlen($password) < 3 or strlen($password) > 15 )
{
$msg=$msg."Password must be more than 3 char legth and maximum 15 char lenght<br/>";
$status= "NOTOK";
}
//Checking to see if both passwords match
if ( $password <> $password2 )
{
$msg=$msg."Both passwords are not matching<br/>";
$status= "NOTOK";
}
$CorrectUser = mysql_query("SELECT * FROM User WHERE username ='$username' AND password = MD5('$cur_password')");
$row = mysql_fetch_array($CorrectUser);
if ($row['username'] == $username)
{
$status = "OK";
}
else {
print("Your username is not in the database. Please check that you enter the correct username and try again.");
$status = "NOTOK";
}
if ($row['cur_password'] == MD5('$cur_password'))
{
$status = "OK";
}
else
{
print("You entered the wrong current passowrd");
$status = "NOTOK";
}
if($status<>"OK"){
echo "<font face='Verdana' size='2' color=red>$msg</font><br><center><input type='button' value='Retry' onClick='history.go(-1)'></center>";
}
else
{ // if all validations are passed.
if(mysql_query("UPDATE User SET password = MD5('$password') WHERE username ='$username'"))
{
echo "<font face='Verdana' size='2' ><center>Thanks <br> Your password changed successfully.</font></center>";
}
else
{
echo "<font face='Verdana' size='2' color=red><center>Sorry <br> Failed to change password.</font></center>";
}
}
?>
<center>
<br><br><a href='Settings.html'>Settings Page</a></center>
</body>
</html>
【问题讨论】：
-
尝试比较转义和非转义哈希，因为这可能是问题所在。
-
请不要转发问题，尤其是当您收到关于第一个问题的有用反馈时
-
以下行：
mysql_select_db($db_username);应该会导致问题，以防数据库名称与用户名不同 -
哈希密码时请使用 SHA256 和 salts。另请参阅You're Probably Storing Passwords Incorrectly