Verify_password():密码与哈希不匹配

Question

如果这是一个新手问题，我很抱歉，但我已经被password_verify函数卡住好几天了。问题似乎是登录时输入的密码与数据库中的密码不匹配。然而，密码确实匹配，我不明白问题出在哪里！密码存储为VARCHAR 255，当我对两个变量使用var dump时，我得到的是：

串(60("$2y$10$vfTK8JhbTjtwN3R2qED59uT1gvlD7Xbczeac7IMGn4kKi/1ETiP2"；串(12("；密码123；

如果我在password_verify 中将位置切换到$password，$row["password"]，则问题不会解决

有人知道问题出在哪里吗？提前感谢

这就是我试图将登录中的密码与数据库中的密码进行比较的方式。

<form method="post" > 
<input class="input" type= "text" name="nom" placeholder="nom" required > <br>
<input class="input" type= "password" name="password" placeholder="password" required><br>

<input class="button" type= "submit" value="Login" name= "Submit1"> 
<?php
//appel a la connexion de bdd
require_once ('conn.php');
///$_Post variables
$email = $_POST['nom'];
$password =  $_POST ['password'];
//Query
$q = $conn->prepare("SELECT * FROM users WHERE nom = :email");
$q->bindParam(':email', $email);
$q->execute(); // eseguo la query
$q->setFetchMode(PDO::FETCH_ASSOC);
$rows = $q->rowCount();
if ($rows > 0) {
while ($row = $q->fetch()) {
var_dump($row["password"]);
var_dump($password);
//Password control
if ((password_verify( $password, $row["password"]))) {
echo 'right';

}
else {
echo 'wrong';

}

}
} 

这就是我首先存储它们的方式

<?php
//connessione bd
include 'conn.php';
include 'forminsertuser.php';

//recupero
if(!empty ($_POST["Submit1"])) 
{ 
$password_hash= password_hash($arr['password'], PASSWORD_DEFAULT);
$arr['nom'] = htmlspecialchars($_POST ['nom']);
$arr['password']= htmlspecialchars( $_POST ['password']);
$arr['rankid']=  $_POST ['rankid'];

$sql = 'INSERT INTO users ( nom, password, rankid) VALUES( :nom, :password, :rankid)';
$statement = $conn->prepare($sql);
$statement->execute([
':nom' => $arr['nom'],
':password' => $password_hash,
':rankid' => $arr['rankid'],
]);
header("Location: process.php");
exit;
};
?>

Answer 1

您的password_hash变量设置在错误的位置。它在初始化之前正在使用$arr。

<?php
//connessione bd
include 'conn.php';
include 'forminsertuser.php';

//recupero
if(!empty ($_POST["Submit1"])) 
{ 
$arr['nom'] = htmlspecialchars($_POST ['nom']);
$arr['password']= htmlspecialchars( $_POST ['password']);
$arr['rankid']=  $_POST ['rankid'];
// shifted here
$password_hash= password_hash($arr['password'], PASSWORD_DEFAULT);

$sql = 'INSERT INTO users ( nom, password, rankid) VALUES( :nom, :password, :rankid)';
$statement = $conn->prepare($sql);
$statement->execute([
':nom' => $arr['nom'],
':password' => $password_hash,
':rankid' => $arr['rankid'],
]);
header("Location: process.php");
exit;
};
?>