PHP重置密码

Question

我对如何加密要在数据库中输入的新密码感到困惑。当我输入密码时，它将加密并检查数据库是否正确，并验证新密码，将其更改为纯文本。

if (count($_POST) > 0) {

    $result = mysqli_query($conn, "SELECT *from users WHERE id='" . $_SESSION["id"] . "'");

    $row = mysqli_fetch_array($result);

    if (MD5(mysqli_real_escape_string($_POST["currentPassword"] == $row["password"]))) {

        mysqli_query($conn, "UPDATE users set password='" . $_POST["newPassword"] . "' WHERE id='" . $_SESSION["id"] . "'");

        $message = "Password Changed";

    } else

        $message = "Current Password is not correct";

}

Answer 1

&nbsp; // password encryption for security.$salt = mcrypt_create_iv(22, MCRYPT_DEV_URANDOM);$salt = base64_encode($salt);$salt = str_replace('+', '.', $salt);$hash = crypt($pass, '$2y$10$'.$salt.'$');//echo ("".$hash."<br />\n");$pass 是密码输入中的密码保存$hash到数据库使用从数据库中获得的密码来验证密码 $hashif(password_verify($pass, $hash)) {&nbsp; &nbsp; echo 'Password is valid!';} else {&nbsp; &nbsp; echo 'Invalid password.';}更新并尝试该过程

Answer 2

//password encryption$user_password = "1234";$hash_pass = password_encryption($user_password, PASSWORD_BCRYPT, array('cost'=>10);//"$user_password"-password obtained from the user input//"$hash_pass" -encrypted password stored in a database//verify the user password with that obtained from the databaseif(password_verify($user_password, $hash_pass)){&nbsp; &nbsp; &nbsp;echo "password is valid";}else{&nbsp; &nbsp; &nbsp;echo "password is not valid";}试试这个。