Question

我正在尝试使用Slim Jquery和Ajax创建一个登录系统。我已经将登录部分与最小问题一起工作，现在我只需要能够对密码进行哈希处理。我知道我可以使用md5，sha1和/或salt进行哈希，但我知道重新使用了password_hash。我知道如何与我提到的任何其他3个哈希，因为在使用bindParam时你可以将它放在变量周围。我的问题是，如何在bindParam中使用password_hash。我在这个网站上找到的最接近的答案没有多大帮助。

我目前的代码是：

$app->post('/addUser/', 'addUser');
function addUser()
{
    $request = \Slim\Slim::getInstance()->request();
    $q = json_decode($request->getBody());

    $sql = "INSERT INTO users(firstName, lastName, userName, password) VALUES (:firstName, :lastName, :userName, :password)";

    try{
        $dbConnection();
        $stmt=$db->prepare($sql);
        $stmt->bindParam("firstName", $q->firstName);
        $stmt->bindParam("lastName", $q->lastName);
        $stmt->bindParam("userName", $q->userName);
        $stmt->bindParam("password", $q->password);
        $stmt->execute();
        $db=null;
    }
    catch(PDOException $e){
        echo $e->getMessage();
    }
}

验证码：

$app->post('/logIn/', 'lonIn');
function logIn()
{
    $request = \Slim\Slim::getInstance()->request();
    $q = json_decode($request->getBody());

    $sql = "SELECT * FROM users WHERE userName=:userName";
    try{
        $db = getConnection();
        $stmt=$db->prepare($sql);
        $stmt->bindParam("userName", $q->userName);
        $execute = $stmt->execute();
        $db = null;
    }
    catch(PDOException $e)
    {
        echo $e->getMessage();
    }
    if($execute == true)
    {
        $array = $stmt->fetch(PDO::FETCH_ASSOC);
        $hashedPassword = $array['password'];
        if(password_verify($q->password), $hashedPassword))
        {
            echo 'Valid';
        }
        else
        {
            echo 'Invalid';
        }
    }
}

任何帮助都将不胜感激。

Answer 1

要加密密码，您需要创建一个新变量$ hashedPassword，您将在每个用户的数据库中存储该变量。在验证用户时，您将从数据库中选择一个用户传递其用户名并使用password_verify（$ passToBeVerified，$ ourHashedpasswordfromDb），这将返回一个布尔值。

      $app->post('/addUser/', 'addUser');

function addUser() {
    $request = \Slim\Slim::getInstance()->request();
    $q = json_decode($request->getBody());
    $hashedPassword = password_hash($q->password, PASSWORD_BCRYPT);

    $sql = "INSERT INTO users(firstName, lastName, userName, password) VALUES (:firstName, :lastName, :userName, :password)";

    try {
        $dbConnection();
        $stmt = $db->prepare($sql);
        $stmt->bindParam(":firstName", $q->firstName);
        $stmt->bindParam(":lastName", $q->lastName);
        $stmt->bindParam(":userName", $q->userName);
        $stmt->bindParam(":password", $hashedPassword);
        $execute = $stmt->execute();
        if ($execute == true) {
            $verifyUser = verifyUser($q->password, $q->userName);
            if ($verifyUser == TRUE) {
                echo 'valid Username and  Password';
            } else {
                echo 'Invalid Username and password';
            }
        }
        $db = null;
    } catch (PDOException $e) {
        echo $e->getMessage();
    }
}

function verifyUser($passWordToVerify, $userNameToVerify) {
    // $request = \Slim\Slim::getInstance()->request();
    //   $q = json_decode($request->getBody());
    //Select a user data according to their username
    $sql = "select firstName, lastName, userName, password from users where userName = :userName";
    try {
        $dbConnection();
        $stmt = $db->prepare($sql);
        $stmt->bindParam(":userName", $userNameToVerify);
        $execute = $stmt->execute();
        $db = null;
    } catch (PDOException $e) {
        echo $e->getMessage();
    }
    if ($execute == True) {
        /*
         * if the query executes and returs the user saved user details lets now compare
         * the password from the db and the password that the user has entered
         */
        $array = $stmt->fetch(PDO::FETCH_ASSOC);
        $hashedPassword = $array['password'];
        if (password_verify($passWordToVerify, $hashedPassword)) {
            echo 'Password is valid!';
            return true;
        } else {
            echo 'Invalid password.';
            return false;
        }
    }
}

将password_hash与bindParam一起使用

1 个答案: