的PHP 5.5的散列API和數據庫

Question

已經散列明文密碼我找到了一個解決方案，以低於基準可以幫助使用PHP PDO人的問題。我測試了它，它的工作原理，但我不確定它是最乾淨的代碼還是最好的。任何改進都歡迎。

下面是引用原題：

我想哈希那些已經在MySQL數據庫中的密碼。我已經可以使用php 5.5散列API來散列新密碼，但是我想知道是否有辦法將所有舊的純文本密碼並將其轉換爲bcrypt散列。我現在正在考慮將密碼複製到一個名爲'hash'的新行，並且在檢查它們正確複製之後，將它們轉換爲散列。但我不確定如何複製密碼行並在同一張表上重命名，或者如何最有效地對所有這些密碼進行哈希處理。

任何有識之士將不勝感激。

這裏是解決方案：

<? 
    // IMPORTANT: only call this script one time or you will double hash and the passwords input by your users won't work anymore 

    // Get Configuration file 
    require("configsecuresavedgames.php"); 

    // Connect to your server 

    $dbh = new PDO("mysql:host=$host;dbname=$dbname;charset=utf8" , $user, $pass); 
    $dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); 
    $dbh->setAttribute(PDO::ATTR_EMULATE_PREPARES, false); 


    /////////////////////////////////////////////////////// 
    // Upload new score 
    /////////////////////////////////////////////////////// 

// set variable $x to 1 to start at ID 1 and then update each row in a loop, adding 1 to the $x variable once done 

$x = 1; 
// Note: Change the statement below so that the number is larger to match the number of users in your database 

while($x <= 100) { 

// select hash for each row... 
    $stmt = $dbh->prepare("SELECT hash FROM $tname WHERE id = $x"); 
    $stmt->execute(); 

    // set the resulting array to associative 
    $result = $stmt->setFetchMode(PDO::FETCH_ASSOC); 

// set $hash variable to hash (from database) for the respective row 

    while($row = $stmt->fetch(PDO::FETCH_ASSOC)) { 
    echo $row['hash']; 
    $hash = $row ['hash']; 
} 

// update hash row with new hash data (note: prior to running the script make sure that you've copied all plain text passwords to the hash row in the database. 


    $newhash = password_hash($hash, PASSWORD_DEFAULT); 
    $sql = "UPDATE securesavegames SET hash = '$newhash' WHERE id = $x"; 


    // Prepare statement 
    $stm = $dbh->prepare($sql); 

    // execute the query 
    $stm->execute(); 

    // echo a message to say the UPDATE succeeded 
    echo $stm->rowCount() . " records UPDATED successfully"; 

    // add to $x so that the hash for the next 'id' will be updated, then the loop will continue. 

$x++; 

} 
$dbh = null; 

?> 

Answer 1

如果你的密碼是純文本格式，只是通過他們通過哈希，你會被設定。

這裏沒有一個簡單的方法有一個查詢做你的更新，因爲password_hash是一個PHP函數。你將不得不提取值，然後通過它們循環。準備好的陳述對此有很大的幫助。

$sql = 'SELECT record_id, password FROM table'; 
$res = $mysqli->query($sql); 

$sql = 'UPDATE table SET password = ? WHERE record_id = ?'; 
$prep = $mysqli->prepare($sql); 
$prep->bind_param('si', $pass, $record); 

while($row = $res->fetch_assoc()) { 
     $pass = password_hash($row['password']); 
     $record = $row['record_id']; 
     $prep->execute(); 
}