如何通過API驗證在移動應用程序中輸入的密碼

Question

我正在爲登錄頁面編寫一個API，其中密碼被加密並存儲在數據庫中，如下所示：「$ 2y $ 08 $ NwjkR19Vafs28PuSmVrd6OIpL2ix2hUZn4cFwwJqseUQJZqJIXpia」。 如何驗證這個打擊通過使用SQL查詢中輸入密碼，下面是我的API代碼：

if (isset($postdata)) { 

    $request = json_decode($postdata); 

    $username = $request->username; 
    $password = $request->password; 

    if($username === NULL && $password === NULL) { 
     $json = array("status" => 0, "message" => "Please enter username and password"); 
    } 
    else { 

     $select_sql = "SELECT `id`, `first_name`, `last_name`, `email`, `phone`, `username`, `password`, `created_on`, `active`, `activation_code` FROM `users` WHERE `email` = '".$username."' AND `password` = '".$password."';"; 
     $select_query = mysqli_query($con,$select_sql); 
     $count = mysqli_num_rows($select_query); 
     $fetch_obj = mysqli_fetch_array($select_query,MYSQLI_BOTH); 
     if($count>0) { 

      $userId = $fetch_obj["id"]; 
      $userEmail = $fetch_obj["email"]; 
      $userDisplayName = $fetch_obj["first_name"]." ".$fetch_obj["last_name"]; 
      $userPhone = $fetch_obj["phone"]; 
      $userName = $fetch_obj["username"]; 
      $userPass = $fetch_obj["password"]; 
      $userCreatedOn = $fetch_obj["created_on"]; 
      $userActive = $fetch_obj["active"]; 
      $userActivationCode = $fetch_obj["activation_code"]; 

      $userDetails = array("UserID" => "$userId", "UserDisplayName" => "$userDisplayName", "UserEmail" => "$userEmail", "UserPhone" => "$userPhone", "UserName" => "$userName", "UserPassword" => "$userPass", "UserCreatedOn" => "$userCreatedOn","UserActive" => "$userActive", "UserActivationCode" => "$userActivationCode"); 

      $json = array("status" => 1, "message" => "Login success.", "UserDetails" => $userDetails); 
     } 
     else { 
      $json = array("status" => 0, "message" => "Invalid username or password.", "query" => $select_sql); 
     } 
    } 
} 
mysqli_close($con); 

我曾嘗試使用下面的代碼嘗試，但無論我在這裏輸入什麼密碼，如有效的密碼，

<?php 

    echo $password = "John@798"; 
    echo $hash = password_hash($password, PASSWORD_BCRYPT); 
    if (password_verify($password, $hash)) { 
    echo 'Password is valid!'; 
    } else { 
    echo 'Invalid password.'; 
    } 
    ?> 

有什麼方法可以檢查輸入的密碼，然後將用戶重定向到主頁？ 請幫助我，我過去兩天一直堅持這一點。在此先感謝

Answer 1

請下次更好地格式化您的代碼。

此功能

<?php 
echo $password = "John@798"; 
echo $hash = password_hash($password, PASSWORD_BCRYPT); 
if (password_verify($password, $hash)) { 
    echo 'Password is valid!'; 
} else { 
    echo 'Invalid password.'; 
} 
?> 

總是表現出有效的密碼，因爲你設置基於密碼的哈希，並驗證其結果的哈希密碼。 如果你希望它返回無效的密碼，將其設置爲別的東西，像這樣的

echo $password = "Wrong Password"; 
echo $hash = password_hash("John@798", PASSWORD_BCRYPT); 

對於你的第一個代碼塊中，$密碼是您存儲在數據庫中的哈希，$爲userpass是密碼用戶進入表單，你需要驗證它。這裏是檢查它是否是有效密碼的代碼。

if (password_verify($userPass, $password)) { 
    echo "Correct Password"; 
} else { 
    echo "Invalid Password"; 
}