Question

我正在使用本教程 http://www.wikihow.com/Create-a-Secure-Login-Script-in-PHP-and-MySQL 安全访问我的网页，我想通过重置密码功能修改它。不幸的是，我的重置密码插件会存储导致帐户无法登录的内容。

此代码正在执行用户注册，其功能类似于魅力

  $random_salt = hash('sha512', uniqid(mt_rand(1, mt_getrandmax()), true));

    // Create salted password 
    $password = hash('sha512', $password . $random_salt);

    // Insert the new user into the database 
    if ($insert_stmt = $mysqli->prepare("INSERT INTO members (username, email, password, salt) VALUES (?, ?, ?, ?)")) {
        $insert_stmt->bind_param('ssss', $username, $email, $password, $random_salt);
        // Execute the prepared query.
        if (! $insert_stmt->execute()) {
            header('Location: ../error.php?err=Registration failure: INSERT');
        }
    }
    header('Location: ./register_success.php');

登录处理：

    // hash the password with the unique salt.
    $password = hash('sha512', $password . $salt);

    if ($stmt->num_rows == 1) {
        // If the user exists we check if the account is locked
        // from too many login attempts 

        if (checkbrute($user_id, $mysqli) == true) {
            // Account is locked 
            // Send an email to user saying their account is locked
            return false;
        } else {
            // Check if the password in the database matches
            // the password the user submitted.
            if ($db_password == $password) {

也可以。（不是我的工作:)）现在我的部分 - 随机字符串生成器，然后进行散列

$characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
$charactersLength = strlen($characters);
$randomString = '';
for ($i = 0; $i < 8; $i++) {
    $randomString .= $characters[rand(0, $charactersLength - 1)];
}

$random_salt = hash('sha512', uniqid(mt_rand(1, mt_getrandmax()), true));

    // Create salted password 
$password = hash('sha512', $randomString . $random_salt);

          if ($insert_stmt = $mysqli->prepare("UPDATE members SET password = ?, salt=? WHERE username= ?")){
        $insert_stmt->bind_param('sss', $password, $random_salt, $username);



$insert_stmt->execute();
                                      $insert_stmt->close();
    }

重置脚本为用户成功修改db，存储正确的salt并更正哈希密码。通过在屏幕上显示随机文本和盐进行测试，然后在此处进行组合 http://www.convertstring.com/cs/Hash/SHA512

任何建议如何跟踪哈希过程或提示如何解决它将不胜感激。

我怀疑JS在客户端散列密码可能会有一些问题

function formhash(form, password) {
    // Create a new element input, this will be our hashed password field. 
    var p = document.createElement("input");

    // Add the new element to our form. 
    form.appendChild(p);
    p.name = "p";
    p.type = "hidden";
    p.value = hex_sha512(password.value);

    // Make sure the plaintext password doesn't get sent. 
    password.value = "";

    // Finally submit the form. 
    form.submit();
}

非常感谢

Answer 1

从您的formhash()登录处理中进行反向工程建议您不应该散列$randomString，而应该散列它的sha512版本。所以在你的密码重置插件而不是这一行：

$password = hash('sha512', $randomString . $random_salt);

使用这两个：

$password = hash('sha512', $randomString);
$password = hash('sha512', $password . $random_salt);

登录表单/密码重置

1 个答案: