-2
散列我的密码(b-crypt)有问题。用户注册成功完成此功能:$hashed = password_hash($password, PASSWORD_DEFAULT);
。但我不知道如何实现这一行代码password_verify($password, $hashed_password)
我的代码。Password_verify,PDO
这是一类用户的一个片段:
class User{
private $db;
public function __construct() {
$this->db = new Database();
}
public function getLoginUser($email, $password){
$sql = "SELECT * FROM tbl_user WHERE email = :email AND password = :password LIMIT 1";
$query = $this->db->pdo->prepare($sql);
$query->bindValue(':email', $email);
$query->bindValue(':password', $password);
$query->execute();
$result = $query->fetch(PDO::FETCH_OBJ);
return $result;
}
public function userLogin($data){
$email = $data['email'];
$password = $data['password'];
$chk_email = $this->emailCheck($email);
if ($email == "" OR $password == "") {
$msg = "<div class='alert alert-danger'><strong>Error! </strong>Field must not be Empty!</div>";
return $msg;
}
if (filter_var($email, FILTER_VALIDATE_EMAIL) === false) {
$msg = "<div class='alert alert-danger'><strong>Error! </strong>The E-mail address is not valid!</div>";
return $msg;
}
if ($chk_email == false) {
$msg = "<div class='alert alert-danger'><strong>Error! </strong>The E-mail address Not Exist!</div>";
return $msg;
}
if (password_verify('password', $hashed)) {
echo 'Password is valid!';
} else {
echo 'Invalid password.';
}
$result = $this->getLoginUser($email, $password);
if ($result) {
Session::init();
Session::set("login", true);
Session::set("id", $result->id);
Session::set("name", $result->name);
Session::set("username", $result->username);
Session::set("loginmsg", "<div class='alert alert-success'><strong>Success! </strong>You are Logged In!</div>");
header("Location: index.php");
} else {
$msg = "<div class='alert alert-danger'><strong>Error! </strong>Data not found!</div>";
return $msg;
}
}
,这是我的login.php与功能USERLOGIN($ _ POST); 。
<?php
$user = new User();
if ($_SERVER['REQUEST_METHOD'] == 'POST' && isset($_POST['login'])) {
$usrLogin = $user->userLogin($_POST);
}
有人可以帮我解决这个问题吗?如果你能为我写这段代码(段),这将会很有帮助。
谢谢
Reegards!
'$ hashed'是定义在哪里以及如何?密码列的长度是多少? –
你的问题是,SQL语句检查密码,但这是不可能的,因为密码哈希被盐渍,因此无法搜索。我试图解释在另一个[回答](http://stackoverflow.com/a/38422760/575765)正确的处理。 – martinstoeckli