如何检索MD5密码

Question

我已经把用户名和md5(密码(放在我的MySQL数据库中。下面是我的旧登录PHP代码。我想添加一些可以检索我的 md5 密码的代码，因为在我的旧代码上没有 md5 密码。我应该在哪里添加md5(密码(？

这是我的完整登录代码：

<?
if ($_POST['username']) {
$username=trim($_POST['username']);
$username = mysql_real_escape_string($username);
$password=trim($_POST['password']);
$password=mysql_real_escape_string($password);
//$password = hash('md5','$password');

if ($password==NULL) {
header("Location: login.php?error=2");
}else{
if($_POST['code']!=$_SESSION['string']){ 
header("Location: login.php?error=1");
}else{
$query = mysql_query("SELECT username,password FROM tb_users WHERE username = '$username'") or die(mysql_error());
if(mysql_num_rows($query) == 0)
{
header("Location: login.php?error=3");
} else {
$data = mysql_fetch_array($query);
if($data['password'] != $password) {
header("Location: login.php?error=4");
}else{
$query = mysql_query("SELECT username,password FROM tb_users WHERE username='$username'  ") or die(mysql_error());
$row = mysql_fetch_array($query);
$nicke=$row['username'];
$passe=$row['password'];
setcookie("usNick",$nicke,time()+36000);
setcookie("usPass",$passe,time()+36000);
$lastlogdate=time();
$lastip = getRealIP();
$querybt = "UPDATE tb_users SET lastlogdate='$lastlogdate', lastiplog='$lastip' WHERE username='$nicke'";
mysql_query($querybt) or die(mysql_error());
$query = mysql_query("SELECT akhirupgrade from tb_upgrade WHERE username = '$username' and status='upgraded'") or die(mysql_error());
if(mysql_num_rows($query) > 0) {
$row = mysql_fetch_array($query);
$akhir=$row["akhirupgrade"];
$tgl=time();
if ($tgl > $akhir) {
$query = mysql_query("update tb_upgrade set status='', date='', paket='', akhirupgrade='' WHERE username='$username' and status='upgraded'");
$query = mysql_query("update tb_users set account='' WHERE username='$username'");
}
}
header("Location: member.php");
}
}
}
}
}
?>

Answer 1

如果您在 php 5.5 或更高版本上运行，我会使用 password_hash((

当您将密码发送到数据库时，只需使用函数对其进行哈希处理

$password = password_hash(filter_input(INPUT_POST, "password"));

当您从数据库中提取密码时，对他们提交的密码执行相同的操作。

$passwordFromDb = $result['password']; //Password from the database
$passwordFromLoginForm = password_hash(filter_input(INPUT_POST, "password");
//Then when youve got the password to check it agaisnt there input
if($passwordFromDb === $passwordFromForm){
    //The password they entered was the same as the password in the database
} else {
    //The password was wrong
}

我还没有测试过这段代码，所以可能会有错误，但希望你能明白这一点:)

PS请不要使用MD5，非常不安全

如果必须使用 md5

$password = md5(filter_input(INPUT_POST, "password"));//Store password

$passwordFromDb = $result['password']; //Password from the database
$passwordFromLoginForm = md5(filter_input(INPUT_POST, "password");
//Then when youve got the password to check it agaisnt there input
if($passwordFromDb === $passwordFromForm){
    //The password they entered was the same as the password in the database
} else {
    //The password was wrong
}