0

我的控制器

// display the login page
    public function index() {
        // on form data
        $onsumbit = $this->input->post('verify');
        if(isset($onsumbit)) {

           $user_name = $this->input->post('user_name');
           $password = $this->input->post('password');

            // verify login
            $verified = $this->login_model->login_verify($user_name,$password);
            // success
            if($verified) {
                redirect('dashboard');
            }
            // failure
            else {
                $this->session->set_flashdata('login_failure','Please check your email and password and try again');
                redirect('index');
            }
        }
        // login page
        $this->load->view('login');
    }

我的模型

public function login_verify($user_name,$password) {
        $hashed_password = $this->verify_password($user_name);
        $this->db->where('user_name',$user_name)->where('password',password_verify($password, $hashed_password));
        $result = $this->db->get('employee');
        if($result -> num_rows() > 0) {

        $session = array(
            'employee_id'   => $result->row()->employee_id,
            'name'          => $result->row()->first_name.' '.$result->row()->last_name,
            'employee_role' => $result->row()->employee_role,
            'is_logged_in'  => TRUE,
        );
        // set session
        $this->session->set_userdata($session);
        return TRUE;
        } else {
            return FALSE;
        }

    }

     private function verify_password($user_name) {
        $this->db->where('user_name',$user_name);
        $result = $this->db->get('employee');
        if($result -> num_rows() > 0) {
         return  $get_password = $result->row(0)->password;
        }

    }

我正在对我的登录名进行密码散列，我添加了默认密码散列（）。当我验证密码无法正常工作时，任何密码类型都会登录到仪表板。我在这里忘记了什么，任何帮助将不胜感激。

4

1 回答 1

1

您可以稍微简化一下，但正如@h2ooooooo 所提到的，您不能从数据库中选择password_verify.

这是我用于身份验证的内容：

public function login()
{
    $this->form_validation->set_rules('email', 'E-mail', 'required|valid_email');
    $this->form_validation->set_rules('password', 'Password', 'required');

    if ($this->form_validation->run()) {

        // Get the actual user from the database, you can use email or username, whatever you want
        $user = $this->user->get($this->input->post('email'));

        // If we have a user, then we can check against the submitted password:
        if ($user && password_verify($this->input->post('password'), $user->password)) {
            $this->session->set_userdata([
                // Your session data 
            ]);
            redirect('/');
        } else {
            $this->session->set_flashdata('error', 'Wrong credintals');
            redirect('login');
        }
    }

    $this->load->view('auth/login');
}
于 2016-04-13T09:43:46.220 回答