로그인 코드는 md5 암호화 된 암호로 로그인합니다

Question

로그인 + 등록 사이트를 만들었습니다. 등록 페이지는 잘 작동하는데, 암호를 쓸 때 암호화된 버전 인 md5를 써야한다는 것을 제외하고는 ... 등록 페이지에서 비밀번호를 암호화하도록했습니다. 로그인 페이지에서 어떻게하면 md5 암호를 작성할 필요가 없도록 만들 수 있습니까?

<? 

$reg = @$_POST['reg']; 
//declaring variables to prevent errors 
$fn = ""; //First Name 
$ln = ""; //Last Name 
$un = ""; //Username 
$em = ""; //Email 
$em2 = ""; //Email 2 
$pswd = ""; //Password 
$pswd2 = ""; // Password 2 
$d = ""; // Sign up Date 
$u_check = ""; // Check if username exists 
//registration form 
$fn = strip_tags(@$_POST['fname']); 
$ln = strip_tags(@$_POST['lname']); 
$un = strip_tags(@$_POST['username']); 
$em = strip_tags(@$_POST['email']); 
$em2 = strip_tags(@$_POST['email2']); 
$pswd = strip_tags(@$_POST['password']); 
$pswd2 = strip_tags(@$_POST['password2']); 
$d = date("Y-m-d"); // Year - Month - Day 

if ($reg) { 
if ($em==$em2) { 
// Check if user already exists 
$u_check = mysql_query("SELECT username FROM users WHERE username='$un'"); 
// Count the amount of rows where username = $un 
$check = mysql_num_rows($u_check); 
if ($check == 0) { 
//check all of the fields have been filed in 
if ($fn&&$ln&&$un&&$em&&$em2&&$pswd&&$pswd2) { 
// check that passwords match 
if ($pswd==$pswd2) { 
// check the maximum length of username/first name/last name does not exceed 25 characters 
if (strlen($un)>25||strlen($fn)>25||strlen($ln)>25) { 
echo "The maximum limit for username/first name/last name is 25 characters!"; 
} 
else 
{ 
// check the maximum length of password does not exceed 25 characters and is not less than 5 characters 
if (strlen($pswd)>30||strlen($pswd)<5) { 
echo "Your password must be between 5 and 30 characters long!"; 
} 
else 
{ 
//encrypt password and password 2 using md5 before sending to database 
$pswd = md5($pswd); 
$pswd2 = md5($pswd2); 
$query = mysql_query("INSERT INTO users VALUES  ('','$un','$fn','$ln','$em','$pswd','$d','0')"); 
die("<h2>Welcome to InstaWord!</h2>Login to your account to get started ..."); 
} 
} 
} 
else { 
echo "Your passwords don't match!"; 
} 
} 
else 
{ 
echo "Please fill in all of the fields"; 
} 
} 
else 
{ 
echo "Username already taken ..."; 
} 
} 
else { 
echo "Your E-mails don't match!"; 
} 
} 
?> 
<table class="homepageTable"> 
    <tr> 
     <td width="60%" valign="top"> 
     <h2>Share your texts!</h2> 
     <img src="img/animation.gif" width="930"> 
     </td> 
     <td width="40%" valign="top"> 
     <h2>Sign up</h2> 
     <form action="#" method="post"> 
     <input type="text" size="25" name="fname" placeholder="First Name" value="<? echo $fn; ?>"> 
     <input type="text" size="25" name="lname" placeholder="Last Name" value="<? echo $ln; ?>"> 
     <input type="text" size="25" name="username" placeholder="Username" value="<? echo $un; ?>"> 
     <input type="text" size="25" name="email" placeholder="Email" value="<? echo $em; ?>"> 
     <input type="text" size="25" name="email2" placeholder="Repeat Email" value="<? echo $em2; ?>"> 
     <input type="password" size="25" name="password" placeholder="Password"> 
     <input type="password" size="25" name="password2" placeholder="Repeat Password"> <br /> 
     <input type="submit" name="reg" value="Sign Up!"> 
     </form> 
     </td> 
     </tr> 
    </table> 
    </body> 
</html> 

그리고 login.php는 다음과 같습니다 : 같은

register.php 보인다

<?php 

session_start(); 


//This displays your login form 

function index(){ 


echo "<form action='?act=login' method='post'>" 

."Username: <input type='text' name='username' size='30'><br>" 

."Password: <input type='password' name='password' size='30'><br>" 

."<input type='submit' value='Login'>" 

."</form>"; 


} 


//This function will find and checks if your data is correct 

function login(){ 


//Collect your info from login form 

$username = $_REQUEST['username']; 

$password = $_REQUEST['password']; 



//Connecting to database 

$connect = mysql_connect("myserver", "username", "password"); 

if(!$connect){ 

die(mysql_error()); 

} 


//Selecting database 

$select_db = mysql_select_db("database_name", $connect); 

if(!$select_db){ 

die(mysql_error()); 

} 


//Find if entered data is correct 


$result = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password'"); 

$row = mysql_fetch_array($result); 

$id = $row['id']; 


$select_user = mysql_query("SELECT * FROM users WHERE id='$id'"); 

$row2 = mysql_fetch_array($select_user); 

$user = $row2['username']; 


if($username != $user){ 

die("Username is wrong!"); 

} 



$pass_check = mysql_query("SELECT * FROM users WHERE username='$username' AND id='$id'"); 

$row3 = mysql_fetch_array($pass_check); 

$email = $row3['email']; 

$select_pass = mysql_query("SELECT * FROM users WHERE username='$username' AND id='$id' AND email='$email'"); 

$row4 = mysql_fetch_array($select_pass); 

$real_password = $row4['password']; 


if($password != $real_password){ 

die("Your password is wrong!"); 

} 




//Now if everything is correct let's finish his/her/its login 


session_register("username", $username); 

session_register("password", $password); 


echo "Welcome, ".$username." please continue on our <a href=index.php>Index</a>"; 





} 


switch($act){ 


default; 

index(); 

break; 


case "login"; 

login(); 

break; 


} 

?> 

날이 문제를 해결 도와주세요 ...

Answer 1

.... 로그인 동안

사용 $ 암호 = MD5 ($ _ REQUEST [ '암호']); 귀하의 login function(). 사용자가 성공적으로 로그인을합니다 다음

는 정상 비밀번호를 취할 것입니다 및 데이터베이스의 암호화 된 버전으로 확인.이 도움이

희망을.

Answer 2

암호화 암호 입력 올바른 로그인 세부 사항을 확인하면서 SQL 쿼리에 세부 사항을 전달할 때 md5()를 사용하십시오. 당신은 확인하기 위해 MD5를 사용하지 않는

$password_encrypt = md5($password); 
$result = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password_encrypt '"); 

Answer 3

strip_tags()을 $_POST['password']에 적용하면 입력 된 값을 암호 해시 기능에 공급하면 안됩니다.

사용자의 암호를 보호하려면 md5 암호를 해싱해야합니다. 당신은

1. 더 나은 해싱 알고리즘이 필요합니다 PHPass
   : 임의의 소금 값을 추가 BCrypt 해시
2. 을

좋은 소식은 당신이 방금 도서관에서 드롭-A를 사용하고 사용할 수 있다는 것입니다

require('PasswordHash.php'); 

$pwdHasher = new PasswordHash(8, FALSE); 

// $hash is what you would store in your database 
$hash = $pwdHasher->HashPassword($_POST['password']); 

// $hash would be the $hashed stored in your database for this user 
$checked = $pwdHasher->CheckPassword($_POST['password'], $hash); 
if ($checked) { 
    echo 'password correct'; 
} else { 
    echo 'wrong credentials'; 
}