問題描述
我正在制作一個(gè)登錄系統(tǒng)，我想對(duì)密碼進(jìn)行散列以使其更安全，但它每次都返回不同的散列，甚至無法使用 password_verify() 進(jìn)行驗(yàn)證，這是我的代碼:
I'm making a login system, and I want to hash the passwords to make them more secure, but it returns a different hash every time, and can't even be verified using password_verify(), here is my code:
$password = password_hash($password4, PASSWORD_DEFAULT);
這是我的驗(yàn)證代碼:
if(password_verify($password4, $dbpassword))
推薦答案
所以讓我們一次一個(gè)部分
So let's take it one part at a time
但它每次都返回不同的哈希
but it returns a different hash every time
就是這個(gè)想法.password_hash 旨在每次生成隨機(jī)鹽.這意味著您必須單獨(dú)分解每個(gè)散列，而不是猜測用于所有內(nèi)容的一種鹽并獲得巨大優(yōu)勢.
That's the idea. password_hash is designed to generate a random salt every time. This means you have to break each hash individually instead of guessing one salt used for everything and having a huge leg up.
無需MD5 或進(jìn)行任何其他散列.如果你想提高 password_hash 的安全性，你可以通過更高的成本(默認(rèn)成本是 10)
There's no need to MD5 or do any other hashing. If you want to raise the security of password_hash you pass a higher cost (default cost is 10)
$password = password_hash($password4, PASSWORD_DEFAULT, ['cost' => 15]);
至于驗(yàn)證
if(password_verify($password4, $dbpassword))
所以 $password4 應(yīng)該是你未散列的密碼，$dbpassword 應(yīng)該是你存儲(chǔ)在數(shù)據(jù)庫中的哈希
So $password4 should be your unhashed password and $dbpassword should be the hash you've stored in your database
這篇關(guān)于password_hash 每次返回不同的值的文章就介紹到這了，希望我們推薦的答案對(duì)大家有所幫助，也希望大家多多支持html5模板網(wǎng)！