Php 记住我，避免重新设置存储的密码

我一直在非常努力地写最有希望的最先进的登录，并记住我的脚本的安全功能。 经过数小时的测试和使一切正常工作，我遇到了一个简单但棘手的问题。用户登录，如果选中“记住我”，则创建cookie，当用户返回网站时，initiate函数检查cookie，如果cookie存在并且与数据库中的auth_key值匹配，则函数将提取用户登录信息电子邮件、密码，并使用登录函数将用户重新登录。问题是，我使用的代码/教程是为未加密的数据库密码而设计的，例如，我想，系统正在尝试对已哈希的密码进行bcrypt哈希

我可以想到两个肮脏的修复，最肮脏的是创建一个避免对密码进行哈希运算的辅助登录函数，仍然肮脏的是在登录时添加一个参数，指定密码是否经过哈希运算，脚本可以相应地进行哈希运算

有更好的办法吗

public function login($email, $password, $remember = false) {

    global $bcrypt;  // Again make get the bcrypt variable, which is defined in init.php, which is included in login.php where this function is called

    $query = $this->db->prepare("SELECT password, id, email, username, accountlevel FROM users WHERE email = ?");
    $query->bindValue(1, $email);

    try{

        $query->execute();
        $data               = $query->fetch();
        $stored_password    = $data['password']; // stored hashed password
        $id                 = $data['id']; // id of the user to be returned if the password is verified, below.
        $email              = $data['email']; //Stored User email.
        $username           = $data{'username'}; //Username.
        $accountlevel       = $data['accountlevel'];

        if($bcrypt->verify($password, $stored_password) === true){ // using the verify method to compare the password with the stored hashed password.

            // Check if user wants account to be saved in cookie
            if($remember)
            {
                // Generate new auth key for each log in (so old auth key can not be used multiple times in case of cookie hijacking).
                $cookie_auth = $bcrypt->randString(10) . $email;
                $auth_key = $bcrypt->genHash($cookie_auth);;
                $auth_query = $this->db->prepare("UPDATE users SET auth_key = ? WHERE id = ?");
                $auth_query->bindValue(1, $auth_key);
                $auth_query->bindValue(2, $id);

                try{
                    $auth_query->execute();
                    setcookie("auth_key", $auth_key, time() + 60 * 60 * 24 * 7, "/", "touringlegends.com", false, true);
                }catch(PDOException $e){
                    die($e->getMessage());
                }

            }

            session_regenerate_id(true);
            $session_id = $id;
            $session_username = $username;
            $session_level = $accountlevel;

            $_SESSION['user_id'] = $session_id;
            $_SESSION['user_level'] = $session_level;
            $_SESSION['user_name'] = $session_username;
            $_SESSION['user_lastactive'] = time();

            return true;    // returning true.

        }else{

            return false;

        }

    }catch(PDOException $e){
        die($e->getMessage());
    }

}

public function initiate()
{
    global $general;

    $logged_in = false;
    if(isset($_SESSION['user_name']))
    {
        $logged_in = true;
    }

    // Check that cookie is set
    if(isset($_COOKIE['auth_key']))
    {
        $auth_key = $general->safe_var($_COOKIE['auth_key']);

        if($logged_in === false)
        {
            // Select user from database where auth key matches (auth keys are unique)
            $auth_key_query = $this->db->prepare("SELECT username, password FROM users WHERE auth_key = ? LIMIT 1");
            $auth_key_query->bindValue(1, $auth_key);

                try{
                    $auth_key_query->execute();
                    $data = $auth_key_query->fetch();

                    if($auth_key_query === false)
                    {
                        // If auth key does not belong to a user delete the cookie
                        setcookie("auth_key", "", time() - 3600);
                    }
                    else
                    {
                            // Go ahead and log in
                            $this->login($data['username'], $data['password'], true);
                    }

                }catch(PDOException $e){
                    die($e->getMessage());
                }
        }
        else
        {
            setcookie("auth_key", "", time() - 3600);
        }
    }

}

---

仍然脏的一个是向登录添加参数，指定密码是否被散列，为什么你认为这是一个肮脏的解决方案？@皮钦我没有一个正当的理由，因为我没有经验，只是感觉会有一个更标准和干净的方式，我错过了。