Question

我的网站上有一个登录系统，有人可以创建一个帐户，然后注销然后重新登录。当用户尝试登录一个不存在的帐户时，会显示一条消息。 “电子邮件/用户名组合不正确”。我遇到的问题是，即使该帐户确实存在，也会显示此消息。

这是index.php

<!DOCTYPE html>
<?php

session_start();

if(isset($_SESSION['username'])) {

header("Location: home.php");

$_SESSION["success"] = "You are now logged in";

}


?>
<html>

<head>


</head>


<body>

<form action="verify_registration_form.php" method="post">
<br>
<input type="username" id="user_name" name="user_name" placeholder="Username" required>
<br><br><br><br><input type="password" id="user_pass_word" name="user_pass_word" placeholder="Password" required>
<br><br><br><br><input type="email" id="user_email" name="user_email" placeholder="Email" required>
<br><br><br><br><input type="submit" class="submit_registration_form_button" id="submit_registration_form_button" name="submit_registration_form_button" value="Sign Up">

</form>

<form action="verify_login_form.php" method="post">

<input type="username" id="user_email_login" name="user_email_login" placeholder="Email" required>
<input type="password" id="user_pass_word_login" name="user_pass_word_login" placeholder="Password" required>
<input type="submit" class="submit_user_login_form_button" id="submit_user_login_form_button" name="submit_registration_form_button" value="Log In">

</form>


</body>


</html>

这是home.php

<!DOCTYPE html>
<?php

session_start();

if(!isset($_SESSION['username'])) {


header('Location: index.php');

}



?>
<html>

<head>


</head>


<body>

<?php

echo $_SESSION["success"];


?>

<?php if (isset($_SESSION['username'])) : ?>

<p>Welcome <?php echo $_SESSION['username']; ?>


<br><br>

<form action="logout.php" method="post">
<input type="submit" id="logoutbutton" name="logoutbutton" class="logoutbutton" value="Logout">
</form>

<?php  endif ?>

</body>


</html>

这是verify_login_form.php

<!DOCTYPE html>
<?php

session_start();


if($_SERVER['REQUEST_METHOD'] != 'POST') {

header("Location: index.php");

}else{

$connection = mysqli_connect("localhost", "root", "", "websiteusers");

if(!$connection) {

echo "Could not connect to MYSQL database";

}else{
echo "Sucessfully connected to MYSQL database";
$connection = mysqli_connect("localhost", "root", "", "websiteusers");
$useremail = mysqli_real_escape_string($connection, 
$_POST["user_email_login"]);
$userpassword = mysqli_real_escape_string($connection, 
$_POST["user_pass_word_login"]);
$query = "SELECT * FROM websiteusers WHERE UserEmail='$useremail' AND UserPassWord='$hasheduserpassword'";
$results = mysqli_query($connection, $query);
if(mysqli_num_rows($results) == 1) {

$_SESSION['username'] = $username;
$_SESSION['success'] = "You are now logged in";
header("Location: home.php");
}else{

echo "Email/Username combination is incorrect";

}



}

}




?>
<html>

<head>


</head>

<body>



</body>



</html>

Answer 1

您不能直接比较哈希密码。您需要改用password_verify。更改：

$hasheduserpassword = password_hash($userpassword, PASSWORD_DEFAULT);
$query = "SELECT * FROM websiteusers WHERE UserEmail='$useremail' AND UserPassWord='$hasheduserpassword'";
$results = mysqli_query($connection, $query);
if(mysqli_num_rows($results) == 1) {

类似于：

$query = "SELECT * FROM websiteusers WHERE UserEmail='$useremail'";
$results = mysqli_query($connection, $query);
if(mysqli_num_rows($results) == 1 && $row = mysqli_fetch_assoc($results) && password_verify($userpassword, $row['UserPassWord'])) {

这样做的原因是password_hash()使用随机盐来增强哈希安全性，并且生成的哈希包含该盐。 password_verify()从此哈希中提取盐，并使用相同的盐对比较的字符串进行哈希处理，结果（如果两个密码相同）在同一哈希中，而第二次使用password_hash()则得到使用了不同的随机盐，该盐将不会生成相同的哈希，因此比较将失败（感谢@Aurelien进行解释）。

请注意，即使使用mysqli_real_escape_string也不会使您完全不受SQL注入的影响，而应该使用准备好的语句。

电子邮件/用户名组合是登录系统中的错误错误

1 个答案: