使用输入的密码验证哈希密码时遇到问题

Question

我正尝试使用用户输入的密码来验证存储在数据库中的哈希密码。但我没有成功。我正在使用password_verify来比较密码，但即使我输入正确的密码，它也没有给出答案。 请帮助我！

 <?php 
     print_r($_POST); 
     include('connect.php'); 
     var_dump($_POST); 
     print_r($_POST); 
     $tbl_name = 'userC'; 


     if(isset($_POST["USERNAME"]) && isset($_POST["USER_PASSWORD"])) 
     { 
      $username1 = $_POST["USERNAME"]; 
      $password1 = $_POST["USER_PASSWORD"]; 
     } 

    // To protect MySQL injection 
     $username1 = stripslashes($username1); 
     $password1 = stripslashes($password1); 



     $stid = oci_parse($conn, "SELECT * FROM $tbl_name where 
     user_name='$username1'"); 
     $result = oci_execute($stid); 
     //$re = oci_fetch_all($stid,$abc); 

     while(($row = oci_fetch_array($stid,OCI_BOTH)) != false) 
     { 
     $password = $row[6]; 
     $username = $row[2]; 
      $re = 1; 
     } 
     if(isset($password)) 
     { 
     if (password_verify($password1, $password)) 
     { 
      $re1=1; 
     } 
     else 
      { 
      $re1 = 0; 
      } 
      } 
     else 
      { 
      $re1 = 0; 
      } 

    // If result matched $username and $password, table row must be 1 row 
     if($re >= 1 && $re1 >= 1) 
     { 
    // Register $username, $password and redirect to file "login_success.php" 
     session_start(); 
     $_SESSION["username"] = $username; 
     header("location:form.php"); 
    } 
     if($re < 1) { 
      $failed = 1; 
       header("location:login.php?msg=failed"); 
     } 
     if($re1 < 1) { 
      $failed = 1; 
      header("location:verify.php?msg1=failed"); 
     } 

      ?> 

Answer 1

从您的代码中删除$password1 = stripslashes($password1);。在传递给password_verify（或password_hash）时，不应修改输入的密码。

顺便说一句，stripslashes不会保护你从SQL注入你。使用准备好的语句和oci_bind_by_name代替：

$stid = oci_parse($conn, "SELECT * FROM $tbl_name where user_name=:uname"); 
oci_bind_by_name($stid, ":uname", $username1); 
$result = oci_execute($stid);