password_verify 返回 false。找不到错误[重复]

Question

我已经尝试解决这个问题大约 2 个月，但似乎无法解决。我有一个返回散列密码的数据库。由于打印出所有信息，我可以确认这是有效的。它可以很好地返回非散列和散列密码，但是当它检查密码时，它总是返回 false。

我不知道该怎么做。这可能很容易，但我似乎无法找到它。

<?php
    session_start();
    $dbip = "localhost";
    $dbuser = "root";
    $dbpass = "";
    $dbname = "projectNitro";
    $conn = new mysqli($dbip, $dbuser, $dbpass, $dbname);

    if($conn->connect_error) {
        echo("Connection failed: " . $conn->connect_error);
    }

    $password = mysqli_real_escape_string($conn, $_GET["pass"]);
    $email = mysqli_real_escape_string($conn, $_GET["email"]);
    $sql = "SELECT * FROM users WHERE email='{$email}' LIMIT 1";
    $query = mysqli_query($conn, $sql);
    $pass = $_GET["pass"];

    if($query == TRUE) {
        $row = mysqli_fetch_array($query);
        $db_password = $row['password'];
        $db_usertype = $row['accountType'];
        $username = $row['username'];
        echo $password;
        echo "<br>";
        echo $db_password;
        echo "<br>";
        $verify = password_verify($pass, $db_password);

        if($verify) {
            $_SESSION['username'] = $username;
            $_SESSION['at'] = $db_usertype;
            header("Location: http://website.com");
        } else {    
            echo("DB Email: "
            .$row["email"]
            ."<br>Username: "
            .$row["username"]
            ."<br>DB Password: "
            .$row["password"]
            ."<br>AccountType: "
            .$row["accountType"]
            ."<br>Inserted Email: "
            .$_GET["email"]
            ."<br>Inserted Password: "
            .$_GET["pass"]."<br>");

            if(password_verify($_GET["pass"], $row["password"])) {
                echo("epic<br>");
            } else {
                echo("not epic<br>");
            }
        }
    } else {
        header("Location: http://website.com");
    }
    $conn->close();
?>

Answer 1

你需要做一些小步骤。只要有效，就继续加紧。

这是一个更简单的代码版本，应该可以使用官方文档中的密码示例：http://php.net/manual/en/function.password-verify.php

还可以使用die(); 在每个{} 块中调试您的代码。 在您当前的代码中，您在这两种情况下都重定向到一个网站，如果您被重定向，真的很难跟踪问题所在！

你有无用和不清楚的变量，例如$dbpass、$db_password 是非常模棱两可的，即使你我都理解它使它无法维护。除了你的编码风格，你还需要缩进！

您需要检查此代码是否有效的下一步是将硬编码密码替换为您拥有的硬编码密码以及硬编码哈希。

<?php

session_start();
$dbip = "localhost";
$dbuser = "root";
$dbpass = "";
$dbname = "projectNitro";
$conn = new mysqli($dbip, $dbuser, $dbpass, $dbname);

if ($conn->connect_error){
  echo("Connection failed: " . $conn->connect_error) . '<br><br>';
}

$password = 'rasmuslerdorf';//mysqli_real_escape_string($conn, $_GET["pass"]);
// $email = mysqli_real_escape_string($conn, $_GET["email"]);
// $sql = "SELECT * FROM users WHERE email='{$email}' LIMIT 1";
// $query = mysqli_query($conn, $sql);
// $pass = $_GET["pass"];

// if ($query == TRUE) {
  // $row = mysqli_fetch_array($query);
  $db_password = '$2y$07$BCryptRequires22Chrcte/VlQH0piJtjXl.0t1XkA8pw9dMXTpOq';
  // $username = $row['username'];

  echo $password;
  echo "<br>";
  echo $db_password;
  echo "<br>";

  if (password_verify($password, $db_password)) {
    die('ok');
  } else {
    die('not ok');
  }
// } else {
//   header("Location: http://website.com");
// }

$conn->close();
?>

---

这里我稍作修改，并在代码中添加了一些 cmets，以帮助您理解该方法。

<?php

session_start();

// This array is used only like a simple namespace.
$dbCredentials = [
  'host' => "localhost",
  'user' => "root",
  'password' => "",
  'dbname' => "projectNitro"
];
$dbConn = new mysqli($dbCredentials['host'], $dbCredentials['user'], $dbCredentials['password'], $dbCredentials['dbname']);

if ($dbConn->connect_error) {
  // Should not continue script if can't connect to DB.
  die("Connection failed: " . $dbConn->dbConnect_error);
}

// You should check the existence of $_GET["pass"] before using it, with empty() or isset().
$passwordToCheck = mysqli_real_escape_string($dbConn, $_GET["pass"]);// Renamed var more meaningful.
$userEmail = mysqli_real_escape_string($dbConn, $_GET["email"]);
$sql = "SELECT * FROM users WHERE email='{$userEmail}' LIMIT 1";// Don't select * if you don't need everything.
$query = mysqli_query($dbConn, $sql);
$pass = $_GET["pass"];// you already have $passwordToCheck.

if ($query) {// Don't need == TRUE
  // $row = mysqli_fetch_array($query);
  $db_password = '$2y$07$BCryptRequires22Chrcte/VlQH0piJtjXl.0t1XkA8pw9dMXTpOq';
  $username = $row['username'];

  echo "$passwordToCheck<br>$db_password<br>";// This is way less verbose than repeating echo and uses less echo functions.

  if (password_verify($passwordToCheck, $db_password)) {// Don't need to keep this condition in a variable. 
    die('ok');// this is just an example to test.
  } else {
    die('not ok');// this is just an example to test.
  }
} else {
  header("Location: http://website.com");// While debugging don't redirect, put die('message');
}

$dbConn->close();
?>