php - MySql Password_verify() 不工作？

Question

在注册过程中，用户的密码作为加密的 BCRYPT 密码保存在数据库中。

我的问题是:为什么我不能用输入的密码验证加密后的数据库密码？

代码:

<?php                       //POST VARIABLES
                    $submit = $_POST['login_submit'];
                    $username = $_POST['login_username'];
                    $password = $_POST['login_password'];
                    $email = $_POST['login_email'];

require 'password_config.php';
if(isset($submit)){
require 'db/connect.php';
//PASSWORD VERIFYING
$pass_query = "SELECT password FROM users WHERE email='$email'";
$queried = mysql_query($pass_query);
while($row = mysql_fetch_array($queried)){
$user_pass = $row['password'];
$veri_password = password_verify($password, $user_pass);
}

//CHECKING NUM ROWS
$sql = "SELECT id, username FROM users WHERE password='$veri_password' AND email='$email'";
$entered_user = mysql_query($sql);
$num_rows = mysql_num_rows($entered_user);


//ERRS ARRAY DECLARED
$errors = array();

//FURTHER VERIFYING
if( $num_rows != 1 )
{
$errors[] = '-Account does not exist ';
}
elseif( $num_rows == 1 )
{
session_start();
while($row = mysql_fetch_array($entered_user)){
$_SESSION['key'] === true;
$_SESSION['id'] = $row['id'];
$_SESSION['email'] = $email;
$_SESSION['user'] = $row['username'];
$_SESSION['pass'] = $password;
header('Location: profile.php');
exit();
}
}
}   
?>

即使我输入了有效信息，我仍收到一条错误消息，提示“帐户不存在”。

谢谢， -尤金

编辑更改为:

        <?php                       //POST VARIABLES
                            $submit = $_POST['login_submit'];
                            $username = $_POST['login_username'];
                            $password = $_POST['login_password'];
                            $email = $_POST['login_email'];

    require 'password_config.php';
    if(isset($submit)){
    require 'db/connect.php';
    //PASSWORD VERIFYING
    $pass_query = "SELECT password FROM users WHERE email='$email'";
    $queried = mysql_query($pass_query);
    while($row = mysql_fetch_array($queried)){
    $user_pass = $row['password'];
    $veri_password = password_verify($password, $user_pass);
    }
    if($veri_password === true){
    //CHECKING NUM ROWS
       $sql = "SELECT id, username FROM users WHERE password='$user_pass' AND email='$email'";
       $entered_user = mysql_query($sql);
       $num_rows = mysql_num_rows($entered_user);


    //ERRS ARRAY ESTABLISHED
       $errors = array();

    //FURTHER VERIFYING
       if( $num_rows != 1 )
       {
       $errors[] = '-Account does not exist ';
       }
       elseif( $num_rows == 1 )
       {
       session_start();
       while($row = mysql_fetch_array($entered_user)){
       $_SESSION['key'] === true;
       $_SESSION['id'] = $row['id'];
       $_SESSION['email'] = $email;
       $_SESSION['user'] = $row['username'];
       $_SESSION['pass'] = $password;
       header('Location: profile.php');
       exit();
       }
       }
       }
    }   
    ?>

Answer 1

更改为:

$sql = "SELECT id, username FROM users WHERE email='$email'";

同时改变:

$veri_password = password_verify($password, $user_pass);

到

if(!password_verify($password, $user_pass)){
   echo 'invalid password';
   exit;
}

无论如何，您的代码容易受到 sql 注入(inject)攻击。请考虑在查询中使用准备好的语句或使用 mysql_real_escape_string 转义输入字符串。 .并且建议使用 mysqli 或 pdo 而不是过程方法