【发布时间】：2019-12-09 07:12:29
【问题描述】：
我有一些 php 脚本可以让我的用户使用电子邮件创建帐户。然后他设置了一个经过哈希处理的密码，并生成了一个盐并将其存储在我的数据库中。现在我正在重置密码，它工作正常，但新密码（更改密码，即使它正确无法验证电子邮件，因为注册时使用了盐和哈希）
下面是我用来加密user_password的Hash函数
public function hashFunction($password) {
$salt = sha1(rand());
$salt = substr($salt, 0, 10);
$encrypted = base64_encode(sha1($password . $salt, true) . $salt);
$hash = array("salt" => $salt, "encrypted" => $encrypted);
return $hash;
}
这是我的重置密码（更改密码但更改密码无法验证）
<?php
if(isset($_POST["reset-password"])) {
require_once('connect.php');
$sql = "UPDATE `oasisdb`.`registration_data` SET `user_password` = '" . ($_POST["user_password"]). "' WHERE `registration_data`.`name` = '" . $_GET["name"] . "'";
$result = mysqli_query($con,$sql);
$success_message = "Password is reset successfully.";
}
?>
<link href="demo-style.css" rel="stylesheet" type="text/css">
<script>
function validate_password_reset() {
if((document.getElementById("user_password").value == "") && (document.getElementById("confirm_password").value == "")) {
document.getElementById("validation-message").innerHTML = "Please enter new password!"
return false;
}
if(document.getElementById("user_password").value != document.getElementById("confirm_password").value) {
document.getElementById("validation-message").innerHTML = "Both password should be same!"
return false;
}
return true;
}
</script>
<form name="frmReset" id="frmReset" method="post" onSubmit="return validate_password_reset();">
<h1>Reset Password</h1>
<?php if(!empty($success_message)) { ?>
<div class="success_message"><?php echo $success_message; ?></div>
<?php } ?>
<div id="validation-message">
<?php if(!empty($error_message)) { ?>
<?php echo $error_message; ?>
<?php } ?>
</div>
<div class="field-group">
<div><label for="Password">Password</label></div>
<div>
<input type="password" name="user_password" id="user_password" class="input-field"></div>
</div>
<div class="field-group">
<div><label for="email">Confirm Password</label></div>
<div><input type="password" name="confirm_password" id="confirm_password" class="input-field"></div>
</div>
<div class="field-group">
<div><input type="submit" name="reset-password" id="reset-password" value="Reset Password" class="form-submit-button"></div>
</div>
</form>
这是我的 mysql 表
CREATE TABLE `registration_data` (
`id` int(255) NOT NULL,
`name` varchar(150) NOT NULL,
`email` varchar(150) NOT NULL,
`user_password` varchar(80) NOT NULL,
`salt` varchar(10) NOT NULL,
`gender` varchar(50) NOT NULL,
`phone` varchar(50) NOT NULL
) ENGINE=MyISAM DEFAULT CHARSET=latin1;
最后这是我的 login.php
<?php
require_once 'update_user_info.php';
$db = new update_user_info();
// json response array
$response = array("error" => FALSE);
if (isset($_POST['email']) && isset($_POST['password'])) {
// receiving the post params
$email = $_POST['email'];
$password = $_POST['password'];
// get the user by email and password
$user = $db->VerifyUserAuthentication($email, $password);
if ($user != false) {
// use is found
$response["error"] = FALSE;
$response["user"]["name"] = $user["name"];
$response["user"]["email"] = $user["email"];
$response["user"]["phone"] = $user["phone"];
$response["user"]["gender"] = $user["gender"];
echo json_encode($response);
} else {
// user is not found with the credentials
$response["error"] = TRUE;
$response["error_msg"] = "Wrong E-mail or Password. Please try again!";
echo json_encode($response);
}
} else {
// required post params is missing
$response["error"] = TRUE;
$response["error_msg"] = "Required parameters E-mail and Password is missing!";
echo json_encode($response);
}
?>
这是在注册时使用哈希的方式
public function StoreUserInfo($name, $email, $password, $gender, $phone) {
$hash = $this->hashFunction($password);
$user_password = $hash["encrypted"]; // encrypted password
$salt = $hash["salt"]; // salt
$stmt = $this->conn->prepare("INSERT INTO registration_data(name, email, user_password, salt, gender, phone) VALUES(?, ?, ?, ?, ?, ?)");
$stmt->bind_param("ssssss", $name, $email, $user_password, $salt, $gender, $phone);
$result = $stmt->execute();
$stmt->close();
【问题讨论】：
-
你在哪里使用函数来散列你的密码？第二次使用请声明更新/选择的方法或为不冒 SQL 注入的风险进行任何查询
-
更新了我的问题以适应注册时如何使用散列