尝试用php&msql建立注册表单

Question

我制作了一个简单的注册表单，并将其连接到数据库。如果我是第一次注册，它允许我登录并进入主页。然而，当我注销并尝试再次登录时，它总是显示“错误的密码或电子邮件”，即使我把一切都正确。尝试重置密码，密码成功重置，但当我尝试登录时，它只是再次显示相同的错误。

下面是im使用的注册php代码

//if user signup button 
if(isset($_POST['signup'])){ 
$name = mysqli_real_escape_string($con, $_POST['name']);
$email = mysqli_real_escape_string($con, $_POST['email']);
$password = mysqli_real_escape_string($con, $_POST['password']);
$cpassword = mysqli_real_escape_string($con, $_POST['cpassword']);
if($password !== $cpassword){
    $errors['password'] = "Confirm password not matched!";
}
$email_check = "SELECT * FROM usertable WHERE email = '$email'";
$res = mysqli_query($con, $email_check);
if(mysqli_num_rows($res) > 0){
    $errors['email'] = "Email that you have entered is already exist!";
}
if(count($errors) === 0){
    $encpass = $password;
    $code = rand(999999, 111111);
    $status = "notverified";
    $insert_data = "INSERT INTO usertable (name, email, password, code, status)
                    values('$name', '$email', '$encpass', '$code', '$status')";
    $data_check = mysqli_query($con, $insert_data);
    if($data_check){
        $subject = "Email Verification Code";
        $message = "Your verification code is $code";
        $sender = "From: [e-mail]";
        if(mail($email, $subject, $message, $sender)){
            $info = "We've sent a verification code to your email - $email";
            $_SESSION['info'] = $info;
            $_SESSION['email'] = $email;
            $_SESSION['password'] = $password;
            header('location: user-otp.php');
            exit();
        }else{
            $errors['otp-error'] = "Failed while sending code!";
        }
    }else{
        $errors['db-error'] = "Failed while inserting data into database!";
    }
}

}

这是登录php脚本im使用

//if user click login button
if(isset($_POST['login'])){
    $email = mysqli_real_escape_string($con, $_POST['email']);
    $password = mysqli_real_escape_string($con, $_POST['password']);
    $check_email = "SELECT * FROM usertable WHERE email = '$email'";
    $res = mysqli_query($con, $check_email);
    if(mysqli_num_rows($res) > 0){
        $fetch = mysqli_fetch_assoc($res);
        $fetch_pass = $fetch['password'];
        if(password_verify($password, $fetch_pass)){
            $_SESSION['email'] = $email;
            $status = $fetch['status'];
            if($status == 'verified'){
              $_SESSION['email'] = $email;
              $_SESSION['password'] = $password;
                header('location: index.php');
            }else{
                $info = "It's look like you haven't still verify your email - $email";
                $_SESSION['info'] = $info;
                header('location: user-otp.php');
            }
        }else{
            $errors['email'] = "Incorrect email or password!";
        }
    }else{
        $errors['email'] = "It's look like you're not yet a member! Click on the bottom link to signup.";
    }
}

Answer 1

当您从注册页面注册新用户时，您将简单的密码存储到用户表中。假设，当您放入password=123时，它将把123存储到usertable中的password列中。

但是，当您尝试使用相同的密码123来login时，您的login页面逻辑会显示密码应该使用password_verify方法来验证。

此方法使用散列算法检查密码。这就是您看到incorect message的原因。您可以更改登录页面逻辑

从if(password_verify($password，$fetch_pass))到if($password==$fetch_pass)

或者正确使用password_verify方法。