在登录脚本中将password_verify放在哪里？

Question

另一个夜晚，另一个问题！

我创建了一个登录页面，如果密码为纯文本形式，则可以正常运行。

我的问题是我的注册表单使用password_hash向表输入加密的密码。

我当前的脚本如下。

注册脚本

$password = password_hash($_POST['password'], PASSWORD_DEFAULT);

登录脚本

<?php
session_start();
    if(isset($_POST['email'], $_POST['password'])){
        require('../../../private_html/db_connection/connection.php');
        $conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password);
        $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

        $query = $conn->prepare("SELECT * FROM user_accounts WHERE email=:email AND password=:password");
        $query->bindParam(':email', $_POST['email']);
        $query->bindParam(':password', $_POST['password']);
        $query->execute();

        if($row = $query->fetch()){
            $_SESSION['email'] = $row['email'];
            $_SESSION['first_name'] = $row['first_name'];
            header("Location: ../../myaccount/myaccount.php");
        }
        else {header("Location:../../login/login.php ");}
    }

?>

我对此有两个问题：

1. 我应该password_verify在哪里放置登录脚本？
2. 不必键入多个$_SESSION['xxx'] = $row['xxx'];即可在“我的帐户”页面上显示用户详细信息，我如何利用$results = $stmt->fetch(PDO::FETCH_ASSOC);已阅读的方法？

提前谢谢了，

西里尔·海象

Answer 1

*阅读代码 *之前 ，请记住，该Fake Registration块将 不在 您的代码中，但是有必要以端到端的方式向您展示。

<?php
session_start();
    // Begin Vault
    // credentials from a secure Vault, not hard-coded
    $servername="localhost";
    $dbname="login_system";
    $username="dbUserName";
    $password="dbPassword";
    // End Vault

    // The following two variables would come from your form, naturally
    // as $_POST[]
    $formEmail="[e-mail]";
    $ctPassword="¿^?fish╔&®)";  // clear text password

    try {
        #if(isset($_POST['email'], $_POST['password'])){
        #require('../../../private_html/db_connection/connection.php');
        $conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password);
        $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

        // Begin Fake Registration
        //   fake it that user already had password set (from some registration insert routine)
        //   the registration routine had SSL/TLS, safely passing bound parameters.
             $hp=password_hash($ctPassword,PASSWORD_DEFAULT); // hashed password, using 
             $conn->query("delete from user_accounts where email='[e-mail]'");
             $conn->query("insert user_accounts(first_name,last_name,email,password) values ('joe','smith','[e-mail]','$hp')");
        //   we are done assuming we had a registration for somewhere in your system
        // End Fake Registration

        $query = $conn->prepare("SELECT * FROM user_accounts WHERE email=:email");
        $query->bindParam(':email', $formEmail);
        $query->execute();

        unset($_SESSION['email']);
        unset($_SESSION['first_name']);

        if(($row = $query->fetch()) && (password_verify($ctPassword,$row['password']))){
            $_SESSION['email'] = $row['email'];
            $_SESSION['first_name'] = $row['first_name'];
            //header("Location: ../../myaccount/myaccount.php");
            echo "hurray, you authenticated.<br/>";
        }
        else {
            //header("Location:../../login/login.php ");
            echo "invalid login<br/>";
        }
        #}
    } catch (PDOException $e) {
        echo 'Connection failed: ' . $e->getMessage();
        exit();
    }
?>

浏览器输出：

欢呼，您通过了身份验证。

请注意，该password_hash()函数利用了随机盐，如果您多次运行它，这很明显，哈希密码使用相同的clearText输入进行 更改
，例如以下哈希密码：

$2y$10$KywNHrGiPaK9JaWvOrc8UORdT8UXe60I2Yvj86NGzdUH1uLITJv/q

$2y$10$vgJnAluvhfdwerIX3pAJ0u2UKi3J.pfvd0vIqAwL0Pjr/A0AVwatW

两者都是如上所述的相同明文密码的后续哈希的结果。在salt和散列cost被烤成哈希密码并保存。这些调用都可以在下面的链接中找到。

从手册password_hash和password_verify中。

架构图

create table user_accounts
(   id int auto_increment primary key,
    first_name varchar(50) not null,
    last_name varchar(50) not null,
    email varchar(100) not null,
    password varchar(255) not null
);