password_verify（$ _ POST ['password']，$ hash）總是返回false密碼

我的問題是，當我嘗試使用正確的密碼登錄時，它仍顯示錯誤消息「您輸入了錯誤密碼，請重試！」（註冊工作正常，如果用戶已經存在，做工精細的零件檢查）下面是代碼：

register.php (works): 
<?php 
include('db_conn.php'); //db connection 
session_start(); 

/* Registration process, inserts user info into the database 
    and sends account confirmation email message 
*/ 

$_SESSION['email'] = $_POST['email']; 
$_SESSION['full_name'] = $_POST['name']; 

// Escape all $_POST variables to protect against SQL injections 
$full_name = $mysqli->escape_string($_POST['name']); 
$email = $mysqli->escape_string($_POST['email']); 
$password = $mysqli->escape_string(password_hash($_POST['password'], PASSWORD_BCRYPT)); 
$usertype = $mysqli->escape_string("A"); 
$hash = $mysqli->escape_string(md5(rand(0,1000))); 

// Check if user with that email already exists 
$result = $mysqli->query("SELECT * FROM user WHERE Email='$email'") or die($mysqli->error()); 

if (isset($_POST["submit"])){ 
// We know user email exists if the rows returned are more than 0 
    if ($result->num_rows > 0) { 

     $_SESSION['message'] = 'User with this email already exists!'; 
     // header("location: error.php"); 

    } 
    else { // Email doesn't already exist in a database, proceed... 

     $sql = "INSERT INTO user (Email, Password, UserType, FullName, Hash) " 
      . "VALUES ('$email','$password', '$usertype','$full_name', '$hash')"; 

     // Add user to the database 
     if ($mysqli->query($sql)){ 


      $_SESSION['logged_in'] = true; // So we know the user has logged in 
      $_SESSION['message'] = 

        "You are registered"; 

      header("location: home.php"); 
     } 

     else { 
      $_SESSION['message'] = 'Registration failed!'; 
      // header("location: error.php"); 
     } 

    } 
} 

?> 




sign_in.php (not working properly): 
<?php 
include('db_conn.php'); //db connection 
session_start(); 

$email = $mysqli->escape_string($_POST['email']); 
$result = $mysqli->query("SELECT * FROM user WHERE Email='$email'"); 


if (isset($_POST["submit"])){ 
    if ($result->num_rows == 0){ // User doesn't exist 
     $_SESSION['message'] = "User with that email doesn't exist!"; 
     // header("location: error.php"); 
    } 
    else { // User exists 
     $user = $result->fetch_assoc(); 
     echo $_POST['password'].$user['Password']; 
     if (password_verify($_POST['password'], $user['Password'])) { 

      $_SESSION['email'] = $user['Email']; 
      $_SESSION['full_name'] = $user['Name']; 
      $_SESSION['user_type'] = $user['UserType']; 


      // This is how we'll know the user is logged in 
      $_SESSION['logged_in'] = true; 

      header("location: home.php"); 
     } 
     else { 
      $_SESSION['message'] = "You have entered wrong password, try again!"; 
      // header("location: error.php"); 
     } 
    } 
} 

?>

來源

2017-06-01 Shan Huang

數據庫是否存儲使用'password_hash（）'生成的密碼的哈希值？ –

雖然密碼正確，但[密碼\ _verify始終無效密碼]可能重複（https://stackoverflow.com/questions/42945269/password-verify-always-invalid-password-although-password-is-correct） – amarnath

@MilanChheda是的，它存儲密碼的哈希值 –

不要逃避密碼哈希，它是安全的直接輸入到DB：

$mysqli->escape_string(password_hash($_POST['password'], PASSWORD_BCRYPT));

發送至：

password_hash($_POST['password'], PASSWORD_BCRYPT);

來源

2017-06-01 04:40:27 Enstage

我仍然無法正確登錄。 –

password_verify（$ _ POST ['password']，$ hash）總是返回false密碼

回答

相關問題