Question

我正在尝试使用password_verify()函数验证数据库中的哈希密码，但它似乎不起作用。请帮忙。

<?php
include("config.php");
include("vendor/password.php");

session_start();

if ($_SERVER["REQUEST_METHOD"] == "POST") {

  $username = mysqli_real_escape_string($db , $_POST['umail']);
  $password = mysqli_real_escape_string($db , $_POST['upassword']);

  $userQuery = "SELECT username, password FROM users WHERE username = '$username' AND password='$password'";
  $result    = mysqli_query($db ,$userQuery);
  $queryRow  = mysqli_fetch_array($result , MYSQLI_ASSOC);
  $queryCount = mysqli_num_rows($result);


  $verifyPassowrd = password_verify($_POST['upassword'] , $queryRow[2]);

  if ($verifyPassowrd){
    header("Location:home.php"); 
  }else{
    echo  "Username Or Password is invalid";
  }
  mysqli_close($db);
}
 ?>

Answer 1

您的密码在数据库中进行了哈希处理在您的查询中，您包含一个非散列密码，因此查询结果将为空集。

无需在查询的WHERE子句中使用密码，因为您要检查password_verify函数中返回的哈希值。

更新了片段（我也修正了错字）：

<?php
include("config.php");
include("vendor/password.php");

session_start();

if ($_SERVER["REQUEST_METHOD"] == "POST") {

  $username = mysqli_real_escape_string($db , $_POST['umail']);

  $userQuery = "SELECT username, password FROM users WHERE username = '$username'";
  $result    = mysqli_query($db, $userQuery);
  $queryRow  = mysqli_fetch_array($result, MYSQLI_ASSOC);
  $queryCount = mysqli_num_rows($result);


  $verifyPassword = password_verify($_POST['upassword'], $queryRow['password']);

  if ($verifyPassword){
    header("Location:home.php"); 
  }else{
    echo  "Username Or Password is invalid";
  }
  mysqli_close($db);
}
?>

password_verify（）未验证

1 个答案: