Куда поместить пароль в скрипт входа?

Прежде чем вы прочитаете код, имейте в виду, что блок Fake Registration не будет в вашем коде, но вам необходимо показать это целиком.

 <?php session_start(); // Begin Vault // credentials from a secure Vault, not hard-coded $servername="localhost"; $dbname="login_system"; $username="dbUserName"; $password="dbPassword"; // End Vault // The following two variables would come from your form, naturally // as $_POST[] $formEmail="jsmith123@gmail.com"; $ctPassword="¿^?fish╔&®)"; // clear text password try { #if(isset($_POST['email'], $_POST['password'])){ #require('../../../private_html/db_connection/connection.php'); $conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password); $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); // Begin Fake Registration // fake it that user already had password set (from some registration insert routine) // the registration routine had SSL/TLS, safely passing bound parameters. $hp=password_hash($ctPassword,PASSWORD_DEFAULT); // hashed password, using $conn->query("delete from user_accounts where email='jsmith123@gmail.com'"); $conn->query("insert user_accounts(first_name,last_name,email,password) values ('joe','smith','jsmith123@gmail.com','$hp')"); // we are done assuming we had a registration for somewhere in your system // End Fake Registration $query = $conn->prepare("SELECT * FROM user_accounts WHERE email=:email"); $query->bindParam(':email', $formEmail); $query->execute(); unset($_SESSION['email']); unset($_SESSION['first_name']); if(($row = $query->fetch()) && (password_verify($ctPassword,$row['password']))){ $_SESSION['email'] = $row['email']; $_SESSION['first_name'] = $row['first_name']; //header("Location: ../../myaccount/myaccount.php"); echo "hurray, you authenticated.<br/>"; } else { //header("Location:../../login/login.php "); echo "invalid login<br/>"; } #} } catch (PDOException $e) { echo 'Connection failed: ' . $e->getMessage(); exit(); } ?> с <?php session_start(); // Begin Vault // credentials from a secure Vault, not hard-coded $servername="localhost"; $dbname="login_system"; $username="dbUserName"; $password="dbPassword"; // End Vault // The following two variables would come from your form, naturally // as $_POST[] $formEmail="jsmith123@gmail.com"; $ctPassword="¿^?fish╔&®)"; // clear text password try { #if(isset($_POST['email'], $_POST['password'])){ #require('../../../private_html/db_connection/connection.php'); $conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password); $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); // Begin Fake Registration // fake it that user already had password set (from some registration insert routine) // the registration routine had SSL/TLS, safely passing bound parameters. $hp=password_hash($ctPassword,PASSWORD_DEFAULT); // hashed password, using $conn->query("delete from user_accounts where email='jsmith123@gmail.com'"); $conn->query("insert user_accounts(first_name,last_name,email,password) values ('joe','smith','jsmith123@gmail.com','$hp')"); // we are done assuming we had a registration for somewhere in your system // End Fake Registration $query = $conn->prepare("SELECT * FROM user_accounts WHERE email=:email"); $query->bindParam(':email', $formEmail); $query->execute(); unset($_SESSION['email']); unset($_SESSION['first_name']); if(($row = $query->fetch()) && (password_verify($ctPassword,$row['password']))){ $_SESSION['email'] = $row['email']; $_SESSION['first_name'] = $row['first_name']; //header("Location: ../../myaccount/myaccount.php"); echo "hurray, you authenticated.<br/>"; } else { //header("Location:../../login/login.php "); echo "invalid login<br/>"; } #} } catch (PDOException $e) { echo 'Connection failed: ' . $e->getMessage(); exit(); } ?> с <?php session_start(); // Begin Vault // credentials from a secure Vault, not hard-coded $servername="localhost"; $dbname="login_system"; $username="dbUserName"; $password="dbPassword"; // End Vault // The following two variables would come from your form, naturally // as $_POST[] $formEmail="jsmith123@gmail.com"; $ctPassword="¿^?fish╔&®)"; // clear text password try { #if(isset($_POST['email'], $_POST['password'])){ #require('../../../private_html/db_connection/connection.php'); $conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password); $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); // Begin Fake Registration // fake it that user already had password set (from some registration insert routine) // the registration routine had SSL/TLS, safely passing bound parameters. $hp=password_hash($ctPassword,PASSWORD_DEFAULT); // hashed password, using $conn->query("delete from user_accounts where email='jsmith123@gmail.com'"); $conn->query("insert user_accounts(first_name,last_name,email,password) values ('joe','smith','jsmith123@gmail.com','$hp')"); // we are done assuming we had a registration for somewhere in your system // End Fake Registration $query = $conn->prepare("SELECT * FROM user_accounts WHERE email=:email"); $query->bindParam(':email', $formEmail); $query->execute(); unset($_SESSION['email']); unset($_SESSION['first_name']); if(($row = $query->fetch()) && (password_verify($ctPassword,$row['password']))){ $_SESSION['email'] = $row['email']; $_SESSION['first_name'] = $row['first_name']; //header("Location: ../../myaccount/myaccount.php"); echo "hurray, you authenticated.<br/>"; } else { //header("Location:../../login/login.php "); echo "invalid login<br/>"; } #} } catch (PDOException $e) { echo 'Connection failed: ' . $e->getMessage(); exit(); } ?> 

Выход из браузера:

ура, вы прошли аутентификацию.

Обратите внимание, что функция password_hash() использует случайную соль, как это видно, если вы запускаете ее несколько раз, с изменением хэшированного пароля с помощью такого же ввода clearText, как эти хешированные пароли:

 $2y$10$KywNHrGiPaK9JaWvOrc8UORdT8UXe60I2Yvj86NGzdUH1uLITJv/q $2y$10$vgJnAluvhfdwerIX3pAJ0u2UKi3J.pfvd0vIqAwL0Pjr/A0AVwatW 

оба из которых являются результатом последующих хеширования, как уже упоминалось, одного и того же текста с четким текстом. Стоимость salt и хэша запекается в хешированный пароль и сохраняется. Эти призывы должны быть прочитаны в ссылках ниже.

Из пароля Manual_hash и password_verify .

схема

 create table user_accounts ( id int auto_increment primary key, first_name varchar(50) not null, last_name varchar(50) not null, email varchar(100) not null, password varchar(255) not null ); 

 $query = $conn->prepare("SELECT * FROM user_accounts WHERE email=?"); $query->execute([$_POST['email']]); if($row = $query->fetch() && password_verify($_POST['password'], $row['password'])){ $_SESSION['user'] = $row;