如何用隨機鹽散列密碼？

Question

這是我用隨機鹽散列密碼的代碼。但不幸的是，它不想工作，它提供了一個不正確的密碼。

用戶編碼其憑據的腳本的第一部分。

<?php 
    echo "enter the username \n"; 
    $username = trim(fgets(STDIN)); 
    echo "enter the password\n"; 
    $password = trim(fgets(STDIN)); 
    //connecting to database 
    $con=mysqli_connect("localhost","sqldata","sqldata","accounts"); 
    // Check connection 
    if (mysqli_connect_errno()) { 
    echo "Failed to connect to MySQL: " . mysqli_connect_error(); 
    } 
    $salt = time(); 
    $hashedPassword = sha1($password . $salt); 
    echo "$hashedPassword"; 
    mysqli_query($con,"INSERT INTO login (username, salt, password) 
    VALUES ('$username', '$hashedPassword','$salt')"); 
    mysqli_close($con) 
?> 

用戶輸入其憑據的腳本的第二部分。

<?php 
    echo "enter the username \n"; 
    $username = trim(fgets(STDIN)); 
    echo "enter the password\n"; 
    $password = trim(fgets(STDIN)); 
    //connecting to database 
    $db = mysql_connect("localhost","sqldata","sqldata") or die(mysql_error()); 
    //selecting our database 
    $db_select = mysql_select_db("accounts", $db) or die(mysql_error()); 
    $result= mysql_query("select * from login where username = '$username' "); 
    if (!$result) exit("$userName wasn't found in the database!"); 
    $row = mysql_fetch_array($result); 
    $storedPassword = $row['password']; 
    $salt = $row['salt']; 
    $hashedPassword = sha1($password . $salt); 
    if ($storedPassword != $hashedPassword) { 
    exit('incorrect password!'); 
    } else { 
    echo "ok"; 
    } 
?> 

Answer 1

您正在將鹽存儲在password列中，反之亦然。

mysqli_query($con,"INSERT INTO login (username, salt, password) 
    VALUES ('$username', '$hashedPassword','$salt')"); 

將此改爲：

mysqli_query($con,"INSERT INTO login (username, password, salt) 
    VALUES ('$username', '$hashedPassword','$salt')");