什么修改在这个PHP中没有密码加密

Question

问题：

我有一个登录/注册应用程序，它以加密的形式在MySQL服务器数据库上存储密码。我想在用户密码中没有加密以备将来恢复。这个PHP不是由我制作的，我也没有这方面的专业知识来编辑它。如果你们可以帮助解决这个问题，那么我可以在数据库中看到用户的密码。新手在这里。

P.S-我不希望任何滥用用户凭据。我尝试了很多为用户提供密码恢复系统的方法，但都没有成功。所以我想保持密码在数据库中可见，这样如果有人要求他/她的密码，我应该能够提供他们。使用保存记录的数据库 你可以看到这行

$hash = $this->hashSSHA($password); 
$encrypted_password = $hash["encrypted"]; // encrypted password 
$salt = $hash["salt"]; // salt 

如果你不想保存加密的密码只需要修改

$result = mysql_query("INSERT INTO users(unique_id, name, email, encrypted_password, number, salt, created_at) VALUES('$uuid', '$name', '$email', '$password', '$number', '$salt', NOW())"); 

P/S

<?php 
class DB_Functions 
{ 
private $db; 

//put your code here 
// constructor 
function __construct() { 
    require_once 'DB_Connect.php'; 
    // connecting to database 
    $this->db = new DB_Connect(); 
    $this->db->connect(); 
} 

// destructor 
function __destruct() { 

} 

/** 
* Storing new user 
* returns user details 
*/ 
public function storeUser($name, $email, $password, $number) { 
    $uuid = uniqid('', true); 
    $hash = $this->hashSSHA($password); 
    $encrypted_password = $hash["encrypted"]; // encrypted password 
    $salt = $hash["salt"]; // salt 
    $result = mysql_query("INSERT INTO users(unique_id, name, email, encrypted_password, number, salt, created_at) VALUES('$uuid', '$name', '$email', '$encrypted_password', '$number', '$salt', NOW())"); 
    // check for successful store 
    if ($result) { 
     // get user details 
     $uid = mysql_insert_id(); // last inserted id 
     $result = mysql_query("SELECT * FROM users WHERE uid = $uid"); 
     // return user details 
     return mysql_fetch_array($result); 
    } else { 
     return false; 
    } 
} 

/** 
* Get user by email and password 
*/ 
public function getUserByEmailAndPassword($email, $password) { 
    $result = mysql_query("SELECT * FROM users WHERE email = '$email'") or die(mysql_error()); 
    // check for result 
    $no_of_rows = mysql_num_rows($result); 
    if ($no_of_rows > 0) { 
     $result = mysql_fetch_array($result); 
     $salt = $result['salt']; 
     $encrypted_password = $result['encrypted_password']; 
     $hash = $this->checkhashSSHA($salt, $password); 
     // check for password equality 
     if ($encrypted_password == $hash) { 
      // user authentication details are correct 
      return $result; 
     } 
    } else { 
     // user not found 
     return false; 
    } 
} 

/** 
* Check user is existed or not 
*/ 
public function isUserExisted($email) { 
    $result = mysql_query("SELECT email from users WHERE email = '$email'"); 
    $no_of_rows = mysql_num_rows($result); 
    if ($no_of_rows > 0) { 
     // user existed 
     return true; 
    } else { 
     // user not existed 
     return false; 
    } 
} 

/** 
* Encrypting password 
* @param password 
* returns salt and encrypted password 
*/ 
public function hashSSHA($password) { 

    $salt = sha1(rand()); 
    $salt = substr($salt, 0, 10); 
    $encrypted = base64_encode(sha1($password . $salt, true) . $salt); 
    $hash = array("salt" => $salt, "encrypted" => $encrypted); 
    return $hash; 
} 

/** 
* Decrypting password 
* @param salt, password 
* returns hash string 
*/ 
public function checkhashSSHA($salt, $password) { 

    $hash = base64_encode(sha1($password . $salt, true) . $salt); 

    return $hash; 
}} ?> 

Answer 1

功能storeUser ：我不推荐使用这种方法来保存密码。这是不好的解决方案。请尝试加密密码，如果用户想重置。只要给他们一个链接通过电子邮件。