-4
我的註冊表和/或登錄頁面上有一個小問題。我可以註冊，但我無法使用新註冊的帳戶登錄。我可以請你的建議傢伙？使用SHA512 encrypyion無法在PHP上創建註冊頁面
execAddEmp.php
<?php
include ("./db_connect.php");
include ("./functions.php");
if(isset($_POST['email'], $_POST['username'], $_POST['status'])) {
$username = $_POST['username'];
$firstname = $_POST['firstname'];
$lastname = $_POST['lastname'];
$mi = $_POST['mi'];
$email = $_POST['email'];
$status = $_POST['status'];
if($result = mysqli_query($mysqli, "SELECT * FROM employee WHERE email='$email'")){
$row_count = mysqli_num_rows($result);
//Now display errors
print ("Email is already in use!<br>");
}
$password = $_POST['password'];
$random_salt = hash('sha512', uniqid(mt_rand(1, mt_getrandmax()), true));
$password = hash('sha512', $password.$random_salt);
print $password;
if ($insert_stmt = $mysqli->prepare("INSERT INTO members (username, firstname, lastname, MI, status, email, password, salt) VALUES (?, ?, ?, ?,?,?,?,?)")) { $insert_stmt->bind_param('ssssssss', $username, $firstname, $lastname, $mi, $status, $email, $password, $random_salt);
// Execute the prepared query.
$insert_stmt->execute();
}
if(!$insert_stmt){
die("There's little problem: ".mysqli_error($mysqli));
}
include("loading.php");
echo '<meta http-equiv="refresh" content="1;url=addemployee.php">';
//echo "<a href='adddivisions.php'>back</a>";
}
else{
echo 'Invalid Request';}
?>
的functions.php
<?php
function sec_session_start() {
$session_name = 'sec_session_id'; // Set a custom session name
$secure = false; // Set to true if using https.
$httponly = true; // This stops javascript being able to access the session id.
ini_set('session.use_only_cookies', 1); // Forces sessions to only use cookies.
$cookieParams = session_get_cookie_params(); // Gets current cookies params.
session_set_cookie_params($cookieParams["lifetime"], $cookieParams["path"], $cookieParams["domain"], $secure, $httponly);
session_name($session_name); // Sets the session name to the one set above.
session_start(); // Start the php session
session_regenerate_id(); // regenerated the session, delete the old one.
}
function login($email, $password, $mysqli) {
// Using prepared Statements means that SQL injection is not possible.
if ($stmt = $mysqli->prepare("SELECT id, username, password, salt FROM members WHERE email = ? LIMIT 1")) {
$stmt->bind_param('s', $email); // Bind "$email" to parameter.
$stmt->execute(); // Execute the prepared query.
$stmt->store_result();
$stmt->bind_result($user_id, $username, $db_password, $salt); // get variables from result.
$stmt->fetch();
$password = hash('sha512', $password.$salt); // hash the password with the unique salt.
if($stmt->num_rows == 1) { // If the user exists
// We check if the account is locked from too many login attempts
if(checkbrute($user_id, $mysqli) == true) {
// Account is locked
// Send an email to user saying their account is locked
return false;
} else {
if($db_password == $password) { // Check if the password in the database matches the password the user submitted.
// Password is correct!
echo $password;
$user_browser = $_SERVER['HTTP_USER_AGENT']; // Get the user-agent string of the user.
$user_id = preg_replace("/[^0-9]+/", "", $user_id); // XSS protection as we might print this value
$_SESSION['user_id'] = $user_id;
$username = preg_replace("/[^a-zA-Z0-9_\-]+/", "", $username); // XSS protection as we might print this value
$_SESSION['username'] = $username;
$_SESSION['login_string'] = hash('sha512', $password.$user_browser);
// Login successful.
return true;
} else {
// Password is not correct
// We record this attempt in the database
$now = time();
$mysqli->query("INSERT INTO login_attempts (user_id, time) VALUES ('$user_id', '$now')");
return false;
}
}
} else {
// No user exists.
return false;
}
}
}
function checkbrute($user_id, $mysqli) {
// Get timestamp of current time
$now = time();
// All login attempts are counted from the past 2 hours.
$valid_attempts = $now - (2 * 60 * 60);
if ($stmt = $mysqli->prepare("SELECT time FROM login_attempts WHERE user_id = ? AND time > '$valid_attempts'")) {
$stmt->bind_param('i', $user_id);
// Execute the prepared query.
$stmt->execute();
$stmt->store_result();
// If there has been more than 5 failed logins
if($stmt->num_rows > 5) {
return true;
} else {
return false;
}
}
}
function login_check($mysqli) {
// Check if all session variables are set
if(isset($_SESSION['user_id'], $_SESSION['username'], $_SESSION['login_string'])) {
$user_id = $_SESSION['user_id'];
$login_string = $_SESSION['login_string'];
$username = $_SESSION['username'];
$user_browser = $_SERVER['HTTP_USER_AGENT']; // Get the user-agent string of the user.
if ($stmt = $mysqli->prepare("SELECT password FROM members WHERE id = ? LIMIT 1")) {
$stmt->bind_param('i', $user_id); // Bind "$user_id" to parameter.
$stmt->execute(); // Execute the prepared query.
$stmt->store_result();
if($stmt->num_rows == 1) { // If the user exists
$stmt->bind_result($password); // get variables from result.
$stmt->fetch();
$login_check = hash('sha512', $password.$user_browser);
if($login_check == $login_string) {
// Logged In!!!!
return true;
} else {
// Not logged in
return false;
}
} else {
// Not logged in
return false;
}
} else {
// Not logged in
return false;
}
} else {
// Not logged in
return false;
}
}
?>
Forms.js
function formhash(form, password) {
// Create a new element input, this will be out hashed password field.
var p = document.createElement("input");
// Add the new element to our form.
form.appendChild(p);
p.name = "p";
p.type = "hidden"
p.value = hex_sha512(password.value);
// Make sure the plaintext password doesn't get sent.
password.value = "";
// Finally submit the form.
form.submit();
}
看起來你已經從js發送一個散列到你的PHP腳本，所以不需要在登錄函數中再次散列它。但它似乎也有一些鹽的問題。 嘗試擺脫JavaScript哈希，並嘗試它是否工作。 – schoash
在您的登錄功能中，從哪裏獲得$ salt值？ –
@FaceOfJock：來自查詢。 $ stmt = $ mysqli-> prepare（「SELECT id，username，password，salt FROM members WHERE email =？LIMIT 1」）; $ stmt-> bind_result（$ user_id，$ username，$ db_password，$ salt）; – JimL