php - 如果密码验证条件中的条件在 php 中无法正常工作

Question

大家好，我正在尝试验证登录页面中的一个条件，即如果我的密码是 change me 那么我想抛出错误消息说请通过单击此链接更改密码如果不，我会将它们重定向到仪表板。

所以我写了 if 条件，但是如果密码不是 change me 也会抛出错误消息

这是我的代码:

 if (isset($_POST['signin'])) {

        global $DB;

        $username = $_POST['username'];
        $password = $_POST['password'];
        echo $password;
        //exit;
        $sql = "SELECT * FROM {user}  where username = ?";

        if ($user = $DB->get_record_sql($sql, array($username))) {
            echo $user->password;
            //exit;
            if (password_verify($password, $user->password)) {
                if(password_verify($password!='changeme',$user->password!='changeme')){
                  if ($user->trackforums == 1) {
                    complete_user_login($user);
                    \core\session\manager::apply_concurrent_login_limit($user->id, session_id());
                    $userauth = get_auth_plugin($USER->auth);

                    $DB->set_field('user', 'firstaccess', date('YmdHis'), array('id' => $user->id));
                    $_SESSION['username'] = $user->username;
                    $_SESSION['firstname'] = $user->firstname;
                    $_SESSION['idnumber'] = $user->idnumber;
                    $_SESSION['id'] = $user->id;
                    $_SESSION['clientid'] = $user->clientid;
                    $_SESSION['maildigest'] = $user->maildigest;
                    $_SESSION['skype'] = $user->skype;
                    $_SESSION['can_access'] = true;
                    $_SESSION['mnethostid'] = 1;
                    $_SESSION['confirmed'] = 1;

                    if (!empty($_POST["remember"])) {
                        setcookie("member_login", $_POST["username"], time() + (10 * 365 * 24 * 60 * 60));
                        setcookie("password", $_POST["password"], time() + (10 * 365 * 24 * 60 * 60));
                    } else {
                        if (isset($_COOKIE["member_login"])) {
                            setcookie("member_login", "");
                        }
                        if (isset($_COOKIE["password"])) {
                            setcookie("password", "");
                        }
                    }

                    if ($user->idnumber == '3')
                        header('location:course.php');
                    elseif ($user->idnumber == '2')
                        header('location:course.php');
                    else
                        header('location:course.php');
                }

                else {
                    ?>
                    <div class="alert alert-danger">
                        <strong> Sorry, User has been Deactivated. Contact Administrator</strong>
                    </div>
                    <?php
                }
            }
                else {
                    ?>
                    <div class="alert alert-primary">
                        <strong>Please change your password!By clicking this link <a style="color:black" href="forgot-password.php">Click Here</a></strong>
                    </div>
                    <?php
                }
            } else {
                ?>
                <div class="alert alert-danger">
                    <strong> Sorry, wrong password.</strong>
                </div>
                <?php
            }
        } else {
            ?>
            <div class="alert alert-danger">
                <strong> Sorry, wrong username.</strong>
            </div>
            <?php
        }
    }

谁能帮我看看我的代码有什么错误。

提前致谢。

Answer 1

password_verify将两个参数都作为 string，而不是作为 bool。您在第二个 password_verify 中将它们作为 bool 传递。在下一行中，$password != 'changeme' & $user->password != 'changeme'，两个表达式都将返回 bool。

if (password_verify($password != 'changeme', $user->password != 'changeme'))

我想，上面一行代码应该是这样的:

if ($password != 'changeme')