使用PDO準備好的語句的PHP crypt驗證錯誤

Question

併爲對不起。我花了一天，無法找到解決方案。我有隱窩（驗證）一個問題，這裏是我的代碼：

function generateHash($password, $round=10){ 
      $salt=substr(base64_encode(openssl_random_pseudo_bytes(17)),0,22); 
      $salt=str_replace("+",".",$salt); 
      $param='$'.implode('$',array(
       "2y", 
       str_pad($round,2,"0",STR_PAD_LEFT), 
       $salt 
       ) 
     ); 
      return crypt($password,$param); 
    } 


//NOW I INSERT HASH TO DB 
    $input = "abc"; 
    $hashed = generateHash($input); 

    $createAccount=$db->prepare("INSERT INTO account .... 
    ':secret' => $hashed; 
    .....)); // Until here, no problem, $hashed can be inserted correctely into my db (password, Varchar (64) 

現在註冊後，用戶喜歡登錄，這裏的問題。首先，我檢查，看看，如果我做得很好的功能

$input = "abc"; 
    $forCheck = "abc"; 
    $hashedHash = generateHash($input); 

    if (crypt($forCheck, $hashedHash) == $hashedHash) { 
     echo "MATCH"; 
    }else { 
     echo "NOT MATCH"; 
    } 
    // OUTPUT: "MATCH" 

的問題在這裏：

$check=$db->prepare("SELECT id, password FROM account WHERE email = :email "); 
    $check->execute(array(
     ':email' => $user 
     ) 
    ); 
    if ($check->rowCount() <= 0) { 
     echo "You are not registered"; 
    }else { 
     $sRow=$check->fetchAll(PDO::FETCH_ASSOC); 
     foreach ($sRow as $row) { 
       $hashedHash = generateHash($row['password']); 

       if (crypt($input, $hashedHash) == $hashedHash) { 
        echo "Passwords Matched"; 
       }else { 
        echo "Passwords did not match"; 
       } 
      } 
     } 
     // OUTPUT: "Passwords did not match" 

任何幫助嗎？

Answer 1

的問題是在這裏...

$hashedHash = generateHash($row['password']); 

你是不是存儲明文密碼，所以你爲什麼要通過generateHash通過哈希來着？應該只是

if (crypt($input, $row['password']) == $row['password']) 

我也想借此機會清理您的查詢邏輯。首先，PDOStatement::rowCount應該而不是被依賴。

$check = $db->prepare('SELECT id, password FROM account WHERE email = :email LIMIT 1'); 
$check->execute([':email' => $user]); 
if ($row = $check->fetch(PDO::FETCH_ASSOC)) { 
    if (crypt($input, $row['password']) == $row['password']) { 
     echo 'Passwords Matched'; 
    } else { 
     echo 'Password did not match'; 
    } 
} else { 
    echo 'You are not registered'; 
}