更改密碼功能

Question

我把以下代碼放在一起。但由於某種原因，它拒絕更新數據庫，並且不管輸入什麼內容，它都會一直回顯$錯誤「您當前的密碼不正確」。

下面是主changepassword.php

<?php 
include 'core/init.php'; //connection to database and checks user sessions 
protect_page(); //useres not loged in cannot access this page 

if (empty($_POST) === false) { 
    $required_fields = array('current_password', 'password', 'password_again'); 
    foreach($_POST as $key=>$value) { 
     if (empty($value) && in_array($key, $required_fields) === true) { 
      $errors[] = 'All fields marked with an * are required.'; //check that all fields are completed 
      break 1; 
     } 
    } 

    if (md5($_POST['current_password']) === $user_data['password']) { //if equal to current password 
     if (trim($_POST['password']) !== trim($_POST['password_again'])) { 
      $errors[] = 'Your new passwords do not match'; 
     } else if (strlen($_POST['password']) < 6) { 
      $errors[] = 'Your password must be at least 6 characters'; 
     } 
    } else { 
     $errors[] = 'Your current password is incorrect'; //else append error 
    } 
} 

include 'includes/overall/header.php'; 
?> 

<h1>Change Password</h1> 
<p>Change your account password here.</p> 

<?php 
if (isset($_GET['success']) && empty($_GET['success'])) { 
    echo 'Your password has been changed'; 
} else { 

    if (empty($_POST) === false && empty($errors) === true) { 
     change_password($session_user_id, $_POST['password']); 
     header('Location: changepassword.php?success'); 
    } else if (empty($errors) === false) { 
     echo output_errors($errors); 
    } 
    ?> 

    <form action="" method="post"> 

     <ul> 
     <li> 
      Current Password*:<br> 
      <input type="password" name"current_password"> 
     </li> 
     <li> 
      New Password*:<br> 
      <input type="password" name"password"> 

     </li> 
     <li> 
      New Password Again*:<br> 
      <input type="password" name"password_again"> 
     </li> 
     <li> 
      <input type="submit" name="Change Password" /> 
     </li> 
     </ul> 

    </form> 

<?php 
} 
include 'includes/overall/footer.php'; ?> 

這裏是

//change password function 
function change_password($membersID, $password) { 
    $membersID = (int)$membersID; 
    $password = md5($password); 
    //update password in database 
    mysql_query("UPDATE`members` SET`password` = '$password' WHERE`membersID` = $membersID"); 
} 

USER_DATA這裏

//user data variable to pass in sessionID and thus pass in their other details 
if (logged_in() === true) { 
    $session_user_id = $_SESSION['membersID']; //picking up the particular user 
    $user_data = user_data($session_user_id, 'membersID', 'username','password', 'forename', 'surename', 'email', 'age'); //picks up the fields declared here - MAKE SURE TO PASS ALL paramameters you need to output. 
    if (user_active($user_data['username']) === false) { 
     session_destroy(); 
     header('Location: index.php'); 
     exit(); 
    } 

} 

Answer 1

聲明的查詢缺少報價的changepassword功能。

function change_password($membersID, $password) { 
    $membersID = (int)$membersID; 
    $password = mysql_real_escape_string(md5($password)); 
    //update password in database 
    mysql_query("UPDATE members SET password = '$password' WHERE membersID = '$membersID';"); 
    if (mysql_affected_rows > 0) { 
     return true; 
    } else { 
     return false; 
    } 
} 


if (empty($_POST) === false && empty($errors) === true) { 
    if(change_password($session_user_id, $_POST['password'])) { 
     // Redirect if change_password returns true 
     header('Location: changepassword.php?success'); 
    } else { 
     // Give some error message 
    } 
} else if (empty($errors) === false) { 
    echo output_errors($errors); 
} 

嘗試這些更改，我不知道如果change_password函數返回false，您想以何種方式處理錯誤。

Answer 2

對不起我的第一個答案是不正確的，但是關於MD5警告仍持有：

請記住，你的密碼架構是非常不安全的，您也應提高一些重要的點。

• 散列函數MD5不apporpriate哈希密碼，因爲 它是如何得太快，而是使用慢速鍵導出函數一樣 BCrypt。我會邀請您，在我的 tutorial中閱讀關於安全密碼存儲的更多信息。
• 直接比較密碼哈希值，只有在沒有使用 鹽的情況下才可以。一個無鹽MD5哈希比存儲 密碼明文更安全。使用包含少於7個字符的密碼破解整個數據庫只需幾秒鐘。
• mysql *函數不推薦使用，建議使用PDO或mysqli代替。請記住，通常您必須在SQL語句中轉義字符串值（準備好的語句或mysqli_real_escape_string()）。你的例子將是安全的，因爲MD5的輸出總是安全的。