password_verify() 对抗 MySQL 不起作用

Question

我用password_hash()散列后，通过PDO将密码，通过表单存储到MySQL数据库中 (瓦尔查尔(512) 字段)

$options = array(
'cost' => 12
);
$password = password_hash($password, PASSWORD_BCRYPT, $options);

假设

$pass = "123Azerty";
//and the hash is
$hash = "$2y$12$TzpGzy1cKM81pkEr/Mn0SOVA4wn0lr.7PnKFg4SU9Hto0EUiGGRMe";

当我从数据库中获取密码并使用 password_verify() 验证它时，它总是返回 false

...
...
$returnedPWD = $row['password'];
if (password_verify($pass,$returnedPWD)){
echo "TRUE";
} else {
echo "FALSE";
}
...
...

在这一点上，我尝试以这种方式"手动"完成

$pass = "123Azerty";
$hash = "$2y$12$TzpGzy1cKM81pkEr/Mn0SOVA4wn0lr.7PnKFg4SU9Hto0EUiGGRMe";
if (password_verify($pass,$hash )){
echo "TRUE";
} else {
echo "FALSE";
}

它总是返回 FALSE

但

当我改变时

$hash = "$2y$12$TzpGzy1cKM81pkEr/Mn0SOVA4wn0lr.7PnKFg4SU9Hto0EUiGGRMe";
// into
$hash = '$2y$12$TzpGzy1cKM81pkEr/Mn0SOVA4wn0lr.7PnKFg4SU9Hto0EUiGGRMe';

成功了。因为括在单引号中的哈希是不可解析的。 根据我的理解，这意味着从数据库中获取的哈希值被解释为可解析(双手提袋)，而不是根本不起作用

然后我试图将字符串括起来 db int strval()：

...
...
$returnedPWD = strval($row['password']);
if (password_verify($pass,$returnedPWD)){
echo "TRUE";
} else {
echo "FALSE";
}
...
...

但它总是返回 FALSE 阅读所有与 password_verify() 不起作用相关的帖子，对我来说，我没有提出任何有效的解决方案。

请问有没有办法让它工作？

提前致谢

编辑 1

我确实尝试使用其他设置作为PASSWORD_DEFAULT但没有更改。 我还尝试在数据库存储中对其进行base64编码，然后对其进行解码。但什么都没有改变

编辑 2

我使用带有参数的PDO存储数据

$query = "INSERT INTO `users` (username, password) VALUES (:username, :password)";
$params = array(
':username' => "$username",
':password' => "$password" // hashed one
);

编辑 3

表结构

CREATE TABLE IF NOT EXISTS `users` (
`id` int(11) NOT NULL AUTO_INCREMENT,
`username` varchar(50) NOT NULL,
`password` varchar(512) NOT NULL,
`enabled` int(1) DEFAULT NULL,
PRIMARY KEY (`id`)
) ENGINE=InnoDB  DEFAULT CHARSET=utf8mb4 AUTO_INCREMENT=13 ;

$username = trim($_POST["username"];
$password = trim($_POST["password"];
// Query to insert data
$query = "INSERT INTO `users` (username, password, enabled) VALUES (:username, :password, 1)";
// The very original setup I did use and didn't work out
$param_password = password_hash($password, PASSWORD_DEFAULT); 
// Bind parameters
$params = array(
':username' => "$username",
':password' => "$param_password"
);
...
...
// insert into db
$sth = $sql->prepare($query);
// Call MySQL
try {
$sth->execute($params); // Execute the Query
} catch (PDOException $e) {
$mysql_error = 'MySQL connection failed: ' . "<br>" . $e->getMessage();
}
...
...

这里是关于我如何从数据库中读取的基本行

...
...
$username_login = trim($_POST["username"]);
$password_login = trim($_POST["password"]);
...
...   
$query = "SELECT * FROM `users` WHERE username = :username";
$params = array(
':username' => $username_login
);   
$sth = $sql->prepare($query);
try{
$sth->execute($params);
} catch (PDOException $e)  {
$mysql_error = 'MySQL connection failed: ' . "<br>" . $e->getMessage();
}
while ($row = $sth->fetch(PDO::FETCH_ASSOC)) {
foreach ($row as $key => $value) {
global $$key;
$$key = $value;
}
}
...
...
if (password_verify($password_login, $password) and $enabled == 1){
// Password is correct, so start a new session
session_start();
// Store data in session variables
$_SESSION["logged"] = true;
$_SESSION["id"] = $id;
$_SESSION["uname"] = $username_login_;                            
// Redirect user to welcome page
header("location: index.php");
} else {
// Display an error message if password is not valid
$password_login__err = "The password you entered was not valid. Or you are not enabled";
}
...
...

Answer 1

由于"$password "，您的代码不起作用 - 它末尾有空格。它应该是：

$query = "INSERT INTO `users` (username, password) VALUES (:username, :password)";
$params = array(
':username' => $username,
':password' => $password, // hashed one
);

---

您的手动测试不起作用，因为

$hash = "$2y$12$TzpGzy1cKM81pkEr/Mn0SOVA4wn0lr.7PnKFg4SU9Hto0EUiGGRMe";

具有双引号，它将$2y、$12和$Tz...内插为导致空字符串的变量。这就是单引号工作的原因。

---

根据您提供的信息，我构建了确实有效的示例代码：检查这里