PHP验证哈希密码在我的功能中不起作用

Question

我正在尝试为我的网站创建一个API，为此我已经为此创建了一个函数。但是该功能无法使用POST功能在POSTMAN中验证我的密码。我一生无法理解我哪里错了。

数据库中的密码使用php hash函数输入：

    $password =password_hash($pass, PASSWORD_DEFAULT);                      

。

public function userLogin($username, $password){

    $stmt = $this->con->prepare("SELECT password FROM farms WHERE farmname = ? ");

    $stmt->bind_param("s", $username);

    $stmt->execute();

    $row = $stmt->get_result()->fetch_assoc();

    $hash = $row['password'];

    if (password_verify($hash, $password)) {

        return $stmt->num_rows > 0; 

    }

}

Login.php文件

require_once '../includes/DbOperations.php';

$response = array();

if($_SERVER['REQUEST_METHOD']=='POST'){

    if(isset($_POST['username']) and isset($_POST['password'])){

        $db = new DbOperations(); 

        if($db->userLogin($_POST['username'], ($_POST['password']))){

            $user = $db->getUserByUsername($_POST['username']);

            $response['error'] = false; 

            $response['username'] = $user['farmname'];

        }else{

            $response['error'] = true; 

            $response['message'] = "Invalid username or password";          

        }

    }else{

        $response['error'] = true; 

        $response['message'] = "Required fields are missing";

    }

}

echo json_encode($response);

我没有得到用户名，而是不断收到错误消息：

{“错误”：true，“消息”：“无效的用户名或密码”}

Answer 1

交换参数：if (password_verify($password,$hash)) {

Answer 2

我认为该userLogin函数应该返回一个值（true / false），而不管密码是否匹配，以便if / else逻辑起作用。由于返回值为password_verifytrue或false，因此可以简单地返回。public function userLogin($username, $password){&nbsp; &nbsp; $sql='select `password` from `farms` where `farmname` = ?'&nbsp; &nbsp; $stmt=$this->con->prepare( $sql );&nbsp; &nbsp; if( !$stmt )return false;&nbsp; &nbsp; $stmt->bind_param( 's', $username );&nbsp; &nbsp; $res=$stmt->execute();&nbsp; &nbsp; if( !$res )return false;&nbsp; &nbsp; $stmt->store_result();&nbsp; &nbsp; $stmt->bind_result( $pwd );&nbsp; &nbsp; $stmt->fetch();&nbsp; &nbsp; $stmt->free_result();&nbsp; &nbsp; $stmt->close();&nbsp; &nbsp; return password_verify( $password, $pwd );}--忙着在车库里忙碌，但根据我数据库中的数据迅速整理了上述功能的一些演示。<?php&nbsp; &nbsp; if( $_SERVER['REQUEST_METHOD']=='POST' ){&nbsp; &nbsp; &nbsp; &nbsp; $dbhost =&nbsp; &nbsp;'localhost';&nbsp; &nbsp; &nbsp; &nbsp; $dbuser =&nbsp; &nbsp;'root';&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; $dbpwd&nbsp; =&nbsp; &nbsp;'xxx';&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; $dbname =&nbsp; &nbsp;'experiments';&nbsp; &nbsp; &nbsp; &nbsp; $db&nbsp; &nbsp; &nbsp;=&nbsp; &nbsp;new mysqli( $dbhost, $dbuser, $dbpwd, $dbname );&nbsp; &nbsp; &nbsp; &nbsp; /*&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; the class from which userLogin originates was unknown so I guessed&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; and made an ultra basic representation of what it might be.&nbsp; &nbsp; &nbsp; &nbsp; */&nbsp; &nbsp; &nbsp; &nbsp; class user{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; private $con;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; public function __construct( $con ){&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $this->con=$con;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; public function userLogin($username, $password){&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $sql='select `password` from `farms` where `farmname` = ?';&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; /*&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; as I do not have a table `farms` I chose another&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; table that has a hashed password column to test against.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; */&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $sql='select `hashpwd` from `users` where `username`=?';&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt=$this->con->prepare( $sql );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if( !$stmt )return false;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt->bind_param( 's', $username );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $res=$stmt->execute();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if( !$res )return false;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt->store_result();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt->bind_result( $pwd );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt->fetch();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt->free_result();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt->close();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return password_verify( $password, $pwd );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; }//end class&nbsp; &nbsp; &nbsp; &nbsp; /* instantiate the class with the db as an argument */&nbsp; &nbsp; &nbsp; &nbsp; $user=new user( $db );&nbsp; &nbsp; &nbsp; &nbsp; /* capture POST vars */&nbsp; &nbsp; &nbsp; &nbsp; $username=filter_input( INPUT_POST,'username',FILTER_SANITIZE_STRING );&nbsp; &nbsp; &nbsp; &nbsp; $password=filter_input( INPUT_POST,'password',FILTER_SANITIZE_STRING );&nbsp; &nbsp; &nbsp; &nbsp; /* test if the password was OK or not... */&nbsp; &nbsp; &nbsp; &nbsp; if( $user->userLogin($username,$password) ){&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo "OK";&nbsp; &nbsp; &nbsp; &nbsp; } else {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo "Bogus";&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; exit();&nbsp; &nbsp; }?><!DOCTYPE html><html>&nbsp; &nbsp; <head>&nbsp; &nbsp; &nbsp; &nbsp; <meta charset='utf-8' />&nbsp; &nbsp; &nbsp; &nbsp; <title>Farm - Form - mySQLi</title>&nbsp; &nbsp; </head>&nbsp; &nbsp; <body>&nbsp; &nbsp; &nbsp; &nbsp; <form method='post'>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <input type='text' name='username' />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <input type='password' name='password' />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <input type='submit' />&nbsp; &nbsp; &nbsp; &nbsp; </form>&nbsp; &nbsp; </body></html>毫不奇怪，结果"OK"表明该功能按预期工作。因此，总而言之，我建议问题出在其他地方

Answer 3

我认为您的功能在if之后需要else语句例如：if (password_verify($hash, $password)) {&nbsp; &nbsp; &nbsp; &nbsp; return $stmt->num_rows > 0;&nbsp;&nbsp; &nbsp; }else{}