php - 在 PHP 中检索加密的密码

Question

以下代码是我用来在 PHP 中加密密码的代码...

$password = sha1(sha1($_POST['password']).sha1("mySalt@$#(%"));

我可以使用什么代码让用户可以使用他们输入的内容登录？

Answer 1

sha1 is a hashing algorithm, not a 2-way encryption. You cannot retrieve the original password.

1. Hash the submitted password using the same algorithm.
2. Fetch, from your database, the password hash for the user in question.
3. Compare the two hashes. If they match, the credentials are OK.

---

• Don't use sha1 for password hashing, it isn't safe enough
• Use a unique salt per credential, don't reuse the same one each time.

Answer 2

You should use crypt for password hashing, sha1/md5 are too weak.

All you need:

function check_password($password) {  
    ...//get db password to compare
    if (crypt($post_password, $db_results[0]['password']) == $db_results[0]['password']) {  
        return true;  
    } else { return false; }
}