如何使用加密（河豚）密码登录现有用户帐户

Question

我在 youtube 上学习了关于如何使用加密河豚功能加密用户密码的教程。我已经将它正确地实现到我的注册脚本中，它成功地注册了一个帐户并将加密的密码发送到数据库。不过，我的问题是在尝试登录用户时检索该加密密码。当我尝试登录现有用户时，它归结为最后一个 else 语句，说它不存在，这意味着散列密码不存在认出来了。

加密密码功能代码：

public function encryptPass($password, $rounds = 11)
        {
            $salt = "";
            // creates array of capital letters A-Z & lowercase as well as #'s 0-9
            $saltChars = array_merge(range('A', 'Z'), range('a', 'z'), range(0,9));

            for($i = 0; $i < 22; $i++)
            {
                // randomize the array
                $salt .= $saltChars[array_rand($saltChars)];
            }

            return crypt($password, sprintf('y$%02d$', $rounds) . $salt);

        }

用于注册帐户的代码：

/// REGISTER ACCOUNT ///
if(isset($_POST['register']))
{
    // clean up the fields
    $username = mysql_real_escape_string(trim($_POST['username']));
    $emailid = mysql_real_escape_string(trim($_POST['emailid']));
    $password = mysql_real_escape_string(trim($_POST['password']));
    $confirmPassword = mysql_real_escape_string(trim($_POST['confirm_password']));
    if($password == $confirmPassword)
    {

        $iUe = $dbMan->ifUsernameExist($username);
        $iEe = $dbMan->ifEmailExist($emailid);

        // if username and email don't already exist, continue with registration
        if(!$iUe && !$iEe)
        {

            // encrypt the users password
            $hashedPassword = $dbMan->encryptPass($password);
            echo "$password <br> \n";

            // register the account
            $register = $dbMan->UserRegister($username, $emailid, $hashedPassword);

            // if registration was succesful
            if($register)
            {
                 echo "<script>alert('Registration Successful')</script>";
            }
            else
            {
                echo "<script>alert('Registration Not Successful')</script>";
            }
        } 
        else 
        {
            echo "<script>alert(' That email or username already exists! ')</script>";
        }
    } 
    else 
    {
        echo "<script>alert(' Passwords do not match! ')</script>";

    }


}

用于登录的代码：

/// LOGIN ACCOUNT /// 
if(isset($_POST['login']))
{   
    // 'convert' post variables to session variables
    $_SESSION['username'] = $_POST['username'];
    $_SESSION['password'] = $_POST['password'];

    // clean em up, get rid of any white spaces or sql injection special chars
    $username = mysql_real_escape_string(trim($_SESSION['username']));
    $password = mysql_real_escape_string($dbMan->encryptPass(trim($_SESSION['password'])));

    echo "$password<br>\n";

    $user = $dbMan->Login($username, $password);
    // if theres an acccount with that username/pw in the db
    if ($user) 
    {

        // login successful
        header("location:index.php");
    } 
    else 
    {
        // Registration Failed
        echo "<script>alert(' The email or password do not match! ')</script>";
    }
}

dbManager 代码：

<?php  

require_once 'dbConnect.php'; 
//session_start();


    class dbManager
    {   
        function __construct() 
        {  
            // connecting to database  
            $db = new dbConnect();  

        }  
        // destructor  
        function __destruct() 
        {  

        }

        public function UserRegister($username, $emailid, $password)
        {  
            $query = mysql_query("INSERT INTO users(username, emailid, password) values('".$username."','".$emailid."','".$password."')") or die(mysql_error());  
            return $query;  

        } 

        public function Login($username, $password)
        {  
            $query = mysql_query("SELECT * FROM users WHERE username = '".$username."' AND password = '".$password."'");  
            $user_data = mysql_fetch_array($query);  
            //print_r($user_data);  
            $num_rows = mysql_num_rows($query);  

            if ($num_rows == 1)   
            {  

                $_SESSION['login'] = true;  
                $_SESSION['uid'] = $user_data['id'];  
                $_SESSION['username'] = $user_data['username'];  
                $_SESSION['emailid'] = $user_data['emailid'];  

                return TRUE; 
            }  
            else  
            {  
                return FALSE;  
            }  


        }


        // check if username exists in db
        public function ifUsernameExist($username)
        {  
            $qr = mysql_query("SELECT * FROM users WHERE username = '".$username."'");  
            echo $row = mysql_num_rows($qr);  
            if($row > 0)
            {  
                return TRUE;
            } 
            else 
            {  
                return FALSE;  
            }  
        }

        // check if email exists in db
        public function ifEmailExist($emailid)
        {
            $qr = mysql_query("SELECT * FROM users WHERE emailid = '".$emailid."'");
            echo $row = mysql_num_rows($qr);
            if($row > 0)
            {
                return TRUE;    
            }
            else
            {
                return FALSE;
            }
        }

        // encrypt password 
        public function encryptPass($password, $rounds = 11)
        {
            $salt = "";
            // creates array of capital letters A-Z & lowercase as well as #'s 0-9
            $saltChars = array_merge(range('A', 'Z'), range('a', 'z'), range(0,9));

            for($i = 0; $i < 22; $i++)
            {
                // randomize the array
                $salt .= $saltChars[array_rand($saltChars)];
            }

            return crypt($password, sprintf('y$%02d$', $rounds) . $salt);

        }

    }  
?>

注意：登录和注册 'methods' 都在同一个 php 文件中，包括表单标记。加密函数位于名为 dbManager 的不同文件中。

希望我能提供足够的信息，让人们能为我指明正确的方向。任何帮助表示赞赏！

谢谢开发者

Answer 1

您需要将明文密码传递给加密，以便在数据库中进行比较。

改变

$password = trim(mysql_real_escape_string($_SESSION['password']));

到

$password = $dbMan->encryptPass(trim(mysql_real_escape_string($_SESSION['password'])));

在您的登录操作中。

理想情况下，在 INSERT 和 SELECT.

上执行 mysql_real_escape_string 之前，您应该运行 $dbMan->encryptPass

$password = mysql_real_escape_string($dbMan->encryptPass(trim($_SESSION['password'])));

加密和解密的盐必须相同，因为您使用的是 array_rand 每次传递的盐都不同。您必须将盐存放在其他地方。如果您移除盐或将其设置为常量，它现在就可以工作了。

如何使用加密（河豚）密码登录现有用户帐户

How to login to an existing user account with an encrypted (blowfish) password

php

encryption

login

registration