我有一个非常简单的登录/用户注册脚本,它使用sha1和salt存储密码。我有密码和用户创建工作正常,并将所有内容存储在数据库中,但是当我尝试使用凭据登录时,它不起作用。在搜索这个主题时,我似乎找不到任何东西。
这是我的添加用户表单:
session_start();
include("includes/resume.config.php");
// make sure form fields have a value and strip them
function check_input($data, $problem='')
{
$data = trim($data);
$data = stripslashes($data);
$data = htmlspecialchars($data);
if ($problem && strlen($data) == 0)
{
die($problem);
}
return $data;
}
// get form values, escape them and apply the check_input function
$name = $link->real_escape_string(check_input($_POST['name'], "Please enter a name!"));
$email = $link->real_escape_string(check_input($_POST['email'], "Please enter an email!"));
$password = $link->real_escape_string(check_input($_POST['password'], "Please enter a password!"));
// generate a random salt for converting passwords into MD5
$salt = bin2hex(mcrypt_create_iv(32, MCRYPT_DEV_URANDOM));
$saltedPW = $password . $salt;
$hashedPW = sha1($saltedPW);
mysqli_connect($db_host, $db_user, $db_pass) OR DIE (mysqli_error());
// select the db
mysqli_select_db ($link, $db_name) OR DIE ("Unable to select db".mysqli_error($db_name));
// our sql query
$sql = "INSERT INTO admins (name, email, password, salt) VALUES ('$name', '$email', '$hashedPW', '$salt');";
//save the updated information to the database
mysqli_query($link, $sql) or die("Error in Query: " . mysqli_error($link));
if (!mysqli_error($link))
{
header("Location: file_insert.php");
}
这是我的登录脚本:这是不起作用的
function check_input($data, $problem='')
{
$data = trim($data);
$data = stripslashes($data);
$data = htmlspecialchars($data);
if ($problem && strlen($data) == 0)
{
die($problem);
}
return $data;
}
if(isset($_POST['submitLogin'])) { //form submitted?
// get form values, escape them and apply the check_input function
$name = $link->real_escape_string(check_input($_POST['name'], "Please enter a name!"));
$password = $link->real_escape_string(check_input($_POST['password'], "Please enter a password!"));
$saltQuery = $link->query('SELECT salt FROM admins WHERE name = "'.$name.'"');
$salt = mysqli_fetch_assoc($saltQuery);
$saltedPW = $password . $salt;
$hashedPW = sha1($saltedPW);
mysqli_connect($db_host, $db_user, $db_pass) OR DIE (mysqli_error());
// select the db
mysqli_select_db ($link, $db_name) OR DIE ("Unable to select db".mysqli_error($db_name));
$validate_user = $link->query('SELECT id, name, password FROM admins WHERE name = "'.$name.'" AND password = "'.$hashedPW.'"');
if ($validate_user->num_rows == 1) {
$row = $validate_user->fetch_assoc();
$_SESSION['id'] = $row['id'];
$_SESSION['loggedin'] = TRUE;
Header('Location: file_insert.php');
} else {
print "<center><p style='margin-top: 200px; font-weight: bold;'>Invalid Login Information</p>";
print "<a href='admin-login.php'>Click here</a> to return to the login page.</center>";
}
}
答案 0 :(得分:3)
可能会有更多事情发生,但肯定有一个原因是因为mysqli_fetch_assoc
返回一个数组,而你正在使用它就像一个字符串。
当你调用$password . $salt
时,PHP会抱怨数组转换为字符串,因为此时$salt
是一个数组。结果是您在密码后附加了Array
,导致错误的哈希值。如果您display_errors
已关闭且/或error_reporting
设置为隐藏php.ini
中的通知,则您将看不到此消息。
如果你改变:
$saltedPW = $password . $salt;
为:
$saltedPW = $password . $salt['salt'];
然后它应该工作。
此外,您应该在将$salt
插入数据库之前将其转义,因为它可能包含null,unprintable或单/双引号,因为它是随机生成的。
答案 1 :(得分:0)
您没有说过是否收到任何错误消息,但是根据您发布的内容我认为这是一个连接问题:
if(isset($_POST['submitLogin'])) { //form submitted?
// Here, you didn't connect to database, but you are expecting to fetch salt!
$saltQuery = $link->query('SELECT salt FROM admins WHERE name = "'.$name.'"');
$salt = mysqli_fetch_assoc($saltQuery);
因此,您可能必须先连接到数据库:
if(isset($_POST['submitLogin'])) { //form submitted?
mysqli_connect($db_host, $db_user, $db_pass) OR DIE (mysqli_error());
// select the db
mysqli_select_db ($link, $db_name) OR DIE ("Unable to select db".mysqli_error($db_name));
// Here, you didn't connect to database, but you are expecting to fetch salt!
$saltQuery = $link->query('SELECT salt FROM admins WHERE name = "'.$name.'"');
其次,mysqli_fetch_assoc返回一个数组,其键名作为您在SELECT查询中嵌入的字段的字段,最终代码应如下所示:
if(isset($_POST['submitLogin'])) { //form submitted?
mysqli_connect($db_host, $db_user, $db_pass) OR DIE (mysqli_error());
// select the db
mysqli_select_db ($link, $db_name) OR DIE ("Unable to select db".mysqli_error($db_name));
// Here, you didn't connect to database, but you are expecting to fetch salt!
$saltQuery = $link->query('SELECT salt FROM admins WHERE name = "'.$name.'"');
$salt = mysqli_fetch_assoc($saltQuery);
$saltedPW = $password . $salt["salt"];
$hashedPW = sha1($saltedPW);