散列密碼不匹配

我創建了一個註冊和一個登錄腳本，它使用完全相同的方式對密碼進行散列，但是當用戶嘗試使用密碼登錄時，散列登錄密碼和存儲在數據庫中的密碼不同，它在幾天前工作，我沒有改變任何登錄和註冊腳本。散列密碼不匹配

這裏是存儲的憑據是什麼

DBEMAIL：[email protected]

DBPASSWORD： addb18f27b6970082727069aa5853116223c5ab46f46a7b07340757804670aef61311ff0254ec45ea78d9ea6d8afb2cefdf3afd6bd4947f6fc558f46703fac1c

下面是用戶插入的憑據：

UEMAIL：[email protected]

UPASSWORD：4123363f30664825356a238fe7a568910315e6f6aa8a57d0264844c641e856ab207200f4c75a532b2ebecdbd062bff31da101d973ab0f83eaefd2323a39a4a88

他們使用散列：

$salt = "salinger"; 
$hashed = hash_hmac("sha512", $password, $salt);

完整的註冊功能（這是凌亂的，但我知道它的工作原理（直到現在）：

function registerUser($firstname, $surname, $email, $password, $secretQ, $secretA, $address, $city, $postcode) { 
    $flag = array(); 
    $validEmail = validateEmail($email); 
    if (($validEmail) == true) { 
     //Do not flag 
    } else { 
     array_push($flag, 1); 
    } 
    if ((textOnly("First name", $firstname) == true) || ((textOnly("Surname", $surname)) == true) || ((textOnly("City", $city)) == true)) { 
     array_push($flag, 1); 
    } 
    if ((emptyField($firstname)) || (emptyField($surname)) || (emptyField($email)) || (emptyField($password)) || (emptyField($secretA)) || (emptyField($address)) || (emptyField($city)) || (emptyField($postcode))) { 
     array_push($flag, 1); 
    } 
    if (validPostcode($postcode) == false) { 
     array_push($flag, 1); 
    } 
    if (duplicateEmail($email) == true) { 
     array_push($flag, 1); 
    } 
    if (validatePassword($password) == false) { 
     array_push($flag, 1); 
    } else { 
     $password = validatePassword($password); 
    } 
    switch ($secretQ) { 
     case 1: 
      $secretQ = "Your mothers maiden name?"; 
      break; 
     case 2: 
      $secretQ = "Name of your first pet?"; 
      break; 
     case 3: 
      $secretQ = "The name of your high school?"; 
      break; 
     case 4: 
      $secretQ = "Your favourite instrument?"; 
      break; 
    } 

    $salt = "salinger"; 
    $hashed = hash_hmac("sha512", $password, $salt); 

    if (!empty($flag)) { 
     echo "There are errors with your registration, go back and ammend it. <br /> <a href=\"register.php\">&lt;&lt; Back</a>"; 
    } else { 
     if ((isset($firstname)) && (isset($surname)) && (isset($email)) && (isset($password)) && (isset($secretQ)) && (isset($secretA)) && (isset($address)) && (isset($city)) && (isset($postcode))) { 
      $sql = "INSERT INTO customer (forename, surname, email, password, secretQ, secretA, address_street, address_city, address_postcode, member_type) VALUES ('$firstname', '$surname', '$email', '$hashed', '$secretQ', '$secretA', '$address', '$city', '$postcode', 'User');"; 
      header("Location: index.php"); 
     } else { 
      array_push($flag, 1); 
     } 
    } 
    $result = mysql_query($sql); 
    if (!$result) { 
     die(mysql_error()); 
    } 
}

登錄功能：

function loginUser($email, $password) { 
    if (validateEmail($email) == true) { 
     $sql = "SELECT customerid, forename, email, password, secretA, member_type FROM customer WHERE email = '$email'"; 

     $result = mysql_query($sql); 

     while ($record = mysql_fetch_array($result)) { 
      $DBid  = $record['customerid']; 
      $DBemail = $record['email']; 
      $DBpassword = $record['password']; 
      $DBforename = $record['forename']; 
      $DBsecretA = $record['secretA']; 
      $DBmember = $record['member_type']; 
     } 

     if (!$result) { 
      die(mysql_error()); 
     } 

     $salt = "salinger"; 
     $hashed = hash_hmac("sha512", $password, $salt); 

     echo "DBEMAIL: $DBemail DBPASSWORD: $DBpassword <br/>"; 
     echo "UEMAIL: $email UPASSWORD: $hashed <br/>"; 

     if (($email == $DBemail) && ($hashed == $DBpassword)) { 
      $match = true; 
     } else { 
      $match = false; 
     } 

     if ($match == true) { 
      session_start(); 
      $_SESSION['userid'] = $DBid; 
      $_SESSION['Active'] = true; 
      $_SESSION['forename'] = $DBforename; 
      $_SESSION['type']  = $DBmember; 
      header("Location: member.php"); 
     } else { 
      echo "Incorrect credentials."; 
     } 
    } else { 
     echo "Invalid email address!"; 
    } 
return true; 
}

來源

2012-12-11 ZeroBased_IX

如果調用'hash_hmac（）'不再產生相同的輸出，我不認爲休息的代碼是相關的。您的主機最近是否升級到較新的PHP版本，如5.4？ –

告訴我們你從哪裏調用'registerUser'的代碼？ – GBD

您在MySQL中爲密碼字段分配了多少個字符？您可能正在存儲截斷的散列。 –

在registerUser中，我會仔細看看這個：

... 
if (validatePassword($password) == false) { 
    array_push($flag, 1); 
} else { 
    $password = validatePassword($password); 
} 
...

$password將被覆蓋，它會顯示，如果它是一個有效的密碼。如果數據庫中的所有密碼都相同，那麼可能是$密碼設置爲true，這就是醃製的值。這取決於你如何使用validatePassword，你可以刪除else從句，離開這個：

... 
if (validatePassword($password) == false) { 
    array_push($flag, 1); 
} 
...

來源

2012-12-11 17:06:44

我其實只是面對面，我不能相信我錯過了這一點。非常感謝，完美的作品。 –

我很高興它的工作原理！沒有憂慮，發生在每個人身上 –

散列密碼不匹配

回答

相關問題