什麼修改在這個PHP中沒有密碼加密

Question

問題：

我有一個登錄/註冊應用程序，它以加密的形式在MySQL服務器數據庫上存儲密碼。我想在用戶密碼中沒有加密以備將來恢復。這個PHP不是由我製作的，我也沒有這方面的專業知識來編輯它。如果你們可以幫助解決這個問題，那麼我可以在數據庫中看到用戶的密碼。新手在這裏。

P.S-我不希望任何濫用用戶憑據。我嘗試了很多爲用戶提供密碼恢復系統的方法，但都沒有成功。所以我想保持密碼在數據庫中可見，這樣如果有人要求他/她的密碼，我應該能夠提供他們。使用保存記錄的數據庫 你可以看到這行

$hash = $this->hashSSHA($password); 
$encrypted_password = $hash["encrypted"]; // encrypted password 
$salt = $hash["salt"]; // salt 

如果你不想保存加密的密碼只需要修改

$result = mysql_query("INSERT INTO users(unique_id, name, email, encrypted_password, number, salt, created_at) VALUES('$uuid', '$name', '$email', '$password', '$number', '$salt', NOW())"); 

P/S

<?php 
class DB_Functions 
{ 
private $db; 

//put your code here 
// constructor 
function __construct() { 
    require_once 'DB_Connect.php'; 
    // connecting to database 
    $this->db = new DB_Connect(); 
    $this->db->connect(); 
} 

// destructor 
function __destruct() { 

} 

/** 
* Storing new user 
* returns user details 
*/ 
public function storeUser($name, $email, $password, $number) { 
    $uuid = uniqid('', true); 
    $hash = $this->hashSSHA($password); 
    $encrypted_password = $hash["encrypted"]; // encrypted password 
    $salt = $hash["salt"]; // salt 
    $result = mysql_query("INSERT INTO users(unique_id, name, email, encrypted_password, number, salt, created_at) VALUES('$uuid', '$name', '$email', '$encrypted_password', '$number', '$salt', NOW())"); 
    // check for successful store 
    if ($result) { 
     // get user details 
     $uid = mysql_insert_id(); // last inserted id 
     $result = mysql_query("SELECT * FROM users WHERE uid = $uid"); 
     // return user details 
     return mysql_fetch_array($result); 
    } else { 
     return false; 
    } 
} 

/** 
* Get user by email and password 
*/ 
public function getUserByEmailAndPassword($email, $password) { 
    $result = mysql_query("SELECT * FROM users WHERE email = '$email'") or die(mysql_error()); 
    // check for result 
    $no_of_rows = mysql_num_rows($result); 
    if ($no_of_rows > 0) { 
     $result = mysql_fetch_array($result); 
     $salt = $result['salt']; 
     $encrypted_password = $result['encrypted_password']; 
     $hash = $this->checkhashSSHA($salt, $password); 
     // check for password equality 
     if ($encrypted_password == $hash) { 
      // user authentication details are correct 
      return $result; 
     } 
    } else { 
     // user not found 
     return false; 
    } 
} 

/** 
* Check user is existed or not 
*/ 
public function isUserExisted($email) { 
    $result = mysql_query("SELECT email from users WHERE email = '$email'"); 
    $no_of_rows = mysql_num_rows($result); 
    if ($no_of_rows > 0) { 
     // user existed 
     return true; 
    } else { 
     // user not existed 
     return false; 
    } 
} 

/** 
* Encrypting password 
* @param password 
* returns salt and encrypted password 
*/ 
public function hashSSHA($password) { 

    $salt = sha1(rand()); 
    $salt = substr($salt, 0, 10); 
    $encrypted = base64_encode(sha1($password . $salt, true) . $salt); 
    $hash = array("salt" => $salt, "encrypted" => $encrypted); 
    return $hash; 
} 

/** 
* Decrypting password 
* @param salt, password 
* returns hash string 
*/ 
public function checkhashSSHA($salt, $password) { 

    $hash = base64_encode(sha1($password . $salt, true) . $salt); 

    return $hash; 
}} ?> 

Answer 1

功能storeUser ：我不推薦使用這種方法來保存密碼。這是不好的解決方案。請嘗試加密密碼，如果用戶想重置。只要給他們一個鏈接通過電子郵件。