如果你还在用md5加密,建议看看下方密码加密和验证方式。
先看一个简单的Password Hashing例子:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
|
<?php
//require 'password.php';
/**
* 正确的密码是secret-password
* $passwordHash 是hash 后存储的密码
* password_verify()用于将用户输入的密码和数据库存储的密码比对。成功返回true,否则false
*/
$passwordHash = password_hash( 'secret-password' , PASSWORD_DEFAULT);
echo $passwordHash ;
if (password_verify( 'bad-password' , $passwordHash )) {
// Correct Password
echo 'Correct Password' ;
} else {
echo 'Wrong password' ;
// Wrong password
}
|
下方代码提供了一个完整的模拟的 User 类,在这个类中,通过使用Password Hashing,既能安全地处理用户的密码,又能支持未来不断变化的安全需求。
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
|
<?php
class User
{
// Store password options so that rehash & hash can share them:
const HASH = PASSWORD_DEFAULT;
const COST = 14; //可以确定该算法应多复杂,进而确定生成哈希值将花费多长时间。(将此值视为更改算法本身重新运行的次数,以减缓计算。)
// Internal data storage about the user:
public $data ;
// Mock constructor:
public function __construct() {
// Read data from the database, storing it into $data such as:
// $data->passwordHash and $data->username
$this ->data = new stdClass();
$this ->data->passwordHash = 'dbd014125a4bad51db85f27279f1040a' ;
}
// Mock save functionality
public function save() {
// Store the data from $data back into the database
}
// Allow for changing a new password:
public function setPassword( $password ) {
$this ->data->passwordHash = password_hash( $password , self::HASH, [ 'cost' => self::COST]);
}
// Logic for logging a user in:
public function login( $password ) {
// First see if they gave the right password:
echo "Login: " , $this ->data->passwordHash, "\n" ;
if (password_verify( $password , $this ->data->passwordHash)) {
// Success - Now see if their password needs rehashed
if (password_needs_rehash( $this ->data->passwordHash, self::HASH, [ 'cost' => self::COST])) {
// We need to rehash the password, and save it. Just call setPassword
$this ->setPassword( $password );
$this ->save();
}
return true; // Or do what you need to mark the user as logged in.
}
return false;
}
}
|
以上这篇详谈PHP中的密码安全性Password Hashing就是小编分享给大家的全部内容了,希望能给大家一个参考,也希望大家多多支持服务器之家。