Php 重新设置正在更改的密码

我目前在哈希方面有问题。这里有一点背景； 用户创建一个帐户，并使用password\u hash$password、password\u BCRYPT对其密码进行散列。然后，当他们登录时，通过password_verify检查密码，如果密码正确，他们将登录

但是，当用户转到他们的个人资料并编辑他们的详细信息、更改密码时，他们将无法再次登录。此外，如果员工更改了用户密码，他们仍然无法登录。 我一直在尝试查找并解决这个问题，但找不到任何东西，最奇怪的是，当一名员工允许管理员帐户更改另一名员工的密码时，他们可以使用新密码正常登录？我已经完成了与更改密码和重新设置代码基本相同的代码，但仍然不起作用

注册：

<?php
        $servername = "localhost"; /*The host of the MySQL name.*/
        $username = "root"; /*MySQL username.*/
        $password = ""; /*MySQL password.*/
        $dbname = ""; /*MySQL database name.*/
        $tablename = "clientinformation"; /*The table name that will be used from the database.*/

        /*This line check if the website can connect to the database, else it will return an error message.*/
        mysql_connect("$servername", "$username", "$password")or die("Cannot connect to the database.");
        /*This line checks if the website can select the database the website is requesting, else it will return an error message.*/
        mysql_select_db("$dbname")or die("Cannot select the database."); 

        $clienttitle = $_POST["clienttitle"]; /*Retrieves the ClientTitle input from the user.*/
        $clientforename = $_POST["clientforename"]; /*Retrieves the ClientForename input from the user.*/
        $clientsurname = $_POST["clientsurname"]; /*Retrieves the ClientSurname input from the user.*/
        $phonenumber = $_POST["phonenumber"]; /*Retrieves the PhoneNumber input from the user.*/ 
        $clientusername = $_POST["clientusername"]; /*Retrieves the Username input from the user.*/
        $clientpassword = $_POST["clientpassword"]; /*Retrieves the ClientPassword input from the user.*/
        $emailaddress = $_POST["emailaddress"]; /*Retrieves the EmailAddress input from the user.*/
        $billingaddress = $_POST["billingaddress"]; /*Retrieves the BillingAddress input from the user.*/
        /*Here, each of the inputs are put through the 'stripslashes' function, which stops a MySQL injection attack.*/
        $clienttitle = stripslashes($clienttitle);
        $clientforename = stripslashes($clientforename);
        $clientsurname = stripslashes($clientsurname);
        $phonenumber = stripslashes($phonenumber);
        $clientusername = stripslashes($clientusername);
        $clientpassword = stripslashes($clientpassword);
        $emailaddress = stripslashes($emailaddress);
        $billingaddress = stripslashes($billingaddress);
        /*The use of mysql_real_escape_string also stops a MySQL injection attack.*/
        $clienttitle = mysql_real_escape_string($clienttitle);
        $clientforename = mysql_real_escape_string($clientforename);
        $clientsurname = mysql_real_escape_string($clientsurname);
        $phonenumber = mysql_real_escape_string($phonenumber);
        $clientusername = mysql_real_escape_string($clientusername);
        $clientpassword = mysql_real_escape_string($clientpassword);
        $emailaddress = mysql_real_escape_string($emailaddress);
        $billingaddress = mysql_real_escape_string($billingaddress);

        $hashedclientpassword = password_hash($clientpassword, PASSWORD_BCRYPT);

            $query = "INSERT INTO $tablename (ClientID, ClientTitle, ClientForename, ClientSurname, PhoneNumber, Username, EmailAddress, ClientPassword, BillingAddress, SignUpDate)VALUES(NULL, '$clienttitle', '$clientforename', '$clientsurname', '$phonenumber', '$clientusername', '$emailaddress', '$hashedclientpassword', '$billingaddress', CURRENT_TIMESTAMP)";

            $result = mysql_query($query);
                if($result){
                    echo "Successful";
                    header("location:Index.php");
                } else {
                    echo ("Unsuccessful : " . mysql_error());
                }
                    mysql_close();
    ?>

检查登录：

<?php
    $servername = "localhost"; /*The host of the MySQL name.*/
    $username = "root"; /*MySQL username.*/
    $password = ""; /*MySQL password.*/
    $dbname = ""; /*MySQL database name.*/
    $tablename = "clientinformation"; /*The table name that will be used from the database.*/

    /*This line check if the website can connect to the database, else it will return an error message.*/
    mysql_connect("$servername", "$username", "$password")or die("Cannot connect to the database.");
    /*This line checks if the website can select the database the website is requesting, else it will return an error message.*/
    mysql_select_db("$dbname")or die("Cannot select the database."); 

    /*This retrieves the data inserted by the user from the previous page. In this case, it is retrieving the username and password the user entered.*/
    $userusername = $_POST["Username"];
    $userpassword = $_POST["ClientPassword"];
    /*Here, these four lines of code are used to stop an MySQL injection attack on the website/database.*/
    $userusername = stripslashes($userusername);
    $userpassword = stripslashes($userpassword);
    $userusername = mysql_real_escape_string($userusername);
    $userpassword = mysql_real_escape_string($userpassword);

    $sql = "SELECT ClientPassword FROM $tablename WHERE Username = '$userusername'";
    $result = mysql_query($sql);
    $datarow = mysql_fetch_array($result);
    $hasheduserpassword = $datarow['0'];

    if (password_verify($userpassword, $hasheduserpassword)) {
        session_start();
        $_SESSION['Username'] = $userusername;
        $_SESSION['ClientPassword'] = $hasheduserpassword;
        header("Location:IndexUserLogin.php");
    } else {
        header("location:WrongPU.php");
    }
?>

用户编辑其详细信息：

<?php
    session_start();
    if(! $_SESSION['Username']) {
        header("location:Index.php");
    }    
    $servername = "localhost";
    $username = "root";
    $password = "";
    $dbname = "";
    $tablename = "clientinformation";

    mysql_connect("$servername", "$username", "$password") or die("Cannot connect to the database.");
    mysql_select_db("$dbname") or die ("Cannot select the database.");

    $clientid = $_POST["clientid"];
    $clienttitle = $_POST["clienttitle"];
    $clientforename = $_POST["clientforename"];
    $clientsurname = $_POST["clientsurname"];
    $phonenumber = $_POST["phonenumber"];
    $clientusername = $_POST["clientusername"];
    $emailaddress = $_POST["emailaddress"];
    $clientpassword = $_POST["clientpassword"];
    $billingaddress = $_POST["billingaddress"];

    $clientid = stripslashes($clientid);
    $clienttitle = stripslashes($clienttitle);
    $clientforename = stripslashes($clientforename);
    $clientsurname = stripslashes($clientsurname);
    $phonenumber = stripslashes($phonenumber);
    $clientusername = stripslashes($clientusername);
    $emailaddress = stripslashes($emailaddress);
    $clientpassword = stripslashes($clientpassword);
    $billingaddress = stripslashes($billingaddress);

    $clientid = mysql_real_escape_string($clientid);
    $clienttitle = mysql_real_escape_string($clienttitle);
    $clientforename = mysql_real_escape_string($clientforename);
    $clientsurname = mysql_real_escape_string($clientsurname);
    $phonenumber = mysql_real_escape_string($phonenumber);
    $clientusername = mysql_real_escape_string($clientusername);
    $emailaddress = mysql_real_escape_string($emailaddress);
    $clientpassword = mysql_real_escape_string($clientpassword);
    $billingaddress = mysql_real_escape_string($billingaddress);

    $hashedclientpassword = password_hash($clientpassword, PASSWORD_BCRYPT);

    $query = "UPDATE $tablename SET ClientTitle = '$clienttitle', ClientForename = '$clientforename', ClientSurname = '$clientsurname', PhoneNumber = '$phonenumber', Username = '$clientusername', EmailAddress = '$emailaddress', ClientPassword = '$hashedclientpassword', BillingAddress = '$billingaddress' WHERE ClientID = '$clientid'";
    $result = mysql_query($query);
    if($result) {
        echo "Successful update";
        header("Location:UserCP.php");
    } else {
        echo ("ERROR : " . mysql_errno . " " . mysql_error());
    }
?>

编辑员工详细信息工作

<?php
    session_start();
    if($_SESSION['EmployeeUsername'] !== "Admin") {
        header("location:Index.php");
    }
    $servername = "localhost";
    $username = "root";
    $password = "";
    $dbname = "";
    $tablename = "employeelogin";

    mysql_connect("$servername", "$username", "$password") or die("Cannot connect to the database.");
    mysql_select_db("$dbname") or die ("Cannot select the database.");

    $employeeid = $_POST['employeeid'];
    $employeeusername = $_POST['employeeusername'];
    $employeepassword = $_POST['employeepassword'];
    $employeename = $_POST['employeename'];
    $employeesurname = $_POST['employeesurname'];

    $employeeid = stripslashes($employeeid);
    $employeeusername = stripslashes($employeeusername);
    $employeepassword = stripslashes($employeepassword);
    $employeename = stripslashes($employeename);
    $employeesurname = stripslashes($employeesurname);

    $employeeid = mysql_real_escape_string($employeeid);
    $employeeusername = mysql_real_escape_string($employeeusername);
    $employeepassword = mysql_real_escape_string($employeepassword);
    $employeename = mysql_real_escape_string($employeename);
    $employeesurname = mysql_real_escape_string($employeesurname);

    $hashedemployeepassword = password_hash($employeepassword, PASSWORD_BCRYPT);

    $query = "UPDATE $tablename SET EmployeeID = '$employeeid', EmployeeUsername = '$employeeusername', EmployeePassword = '$hashedemployeepassword', EmployeeName = '$employeename', EmployeeSurname = '$employeesurname' WHERE EmployeeID = '$employeeid'";
    $result = mysql_query($query);
    if($result) {
        echo "Successful update";
        header("Location:EmployeeCP.php");
    } else {
        echo ("ERROR : " . mysql_errno . " " . mysql_error());
    }
?>

检查员工登录工作

<?php
    $servername = "localhost"; /*The host of the MySQL name.*/
    $username = "root"; /*MySQL username.*/
    $password = ""; /*MySQL password.*/
    $dbname = ""; /*MySQL database name.*/
    $tablename = "employeelogin"; /*The table name that will be used from the database.*/

    /*This line check if the website can connect to the database, else it will return an error message.*/
    mysql_connect("$servername", "$username", "$password")or die("Cannot connect to the database.");
    /*This line checks if the website can select the database the website is requesting, else it will return an error message.*/
    mysql_select_db("$dbname")or die("Cannot select the database."); 

     /*This retrieves the data inserted by the user from the previous page. In this case, it is retrieving the username and password the employee entered.*/
    $employeeusername = $_POST["EmployeeUsername"];
    $employeepassword = $_POST["EmployeePassword"];
    /*Here, these four lines of code are used to stop an MySQL injection attack on the website/database.*/
    $employeeusername = stripslashes($employeeusername);
    $employeepassword = stripslashes($employeepassword);
    $employeeusername = mysql_real_escape_string($employeeusername);
    $employeepassword = mysql_real_escape_string($employeepassword);

    $sql = "SELECT EmployeePassword FROM $tablename WHERE EmployeeUsername = '$employeeusername'";
    $result = mysql_query($sql);
    $datarow = mysql_fetch_array($result);
    $hashedemployeepassword = $datarow['0'];

    if (password_verify($employeepassword, $hashedemployeepassword)) {
        session_start();
        $_SESSION['EmployeeUsername'] = $employeeusername;
        $_SESSION['EmployeePassword'] = $hashedemployeepassword;
        header("Location:IndexEmployeeLogin.php");
    } else {
        header("location:WrongPU.php");
    }
?>

为所有人和任何回应干杯

删除对stripslashes和mysql_real_escape_string的所有调用，以便输入密码、函数甚至接受二进制输入，并且不易于SQL注入。我想这已经解决了你的问题。 转义应该尽可能晚地完成，并且只针对给定的目标系统，因此只应调用函数mysqli_real_escape_string来构建SQL查询

检查clientinformation表和employeelogin表中的密码散列字段是否声明为60个或更多字符。 如果这不能解决您的问题，我会对您的所有页面使用UTF-8。你可以用这个检查你的页面，每个页面都应该以UTF-8文件格式存储，并定义UTF-8头。 使用isset测试变量是否存在：如果！isset$\会话['Username'] 密码散列不应存储在会话中，但这可能只是出于测试目的。 不需要设置用户标识：更新$tablename SET EmployeeID='$EmployeeID'。。。其中EmployeeID=“$EmployeeID”； 在重定向后总是调用exit是一个好习惯：

header('Location: Index.php', true, 303);
exit;

---

你自己测试过吗？我试过自己更改用户密码，通过员工更改用户密码，以及使用管理员帐户更改员工密码。我已经对它们进行了彻底的测试，除了在更改密码后登录时出现“错误的用户名或密码”之外，其他功能都可以正常工作。没有得到任何mysql错误或诸如此类的东西，我能立即看到指出的只有1。您正在使用不推荐的mysql函数。考虑切换到PDO或MySQL，并使用准备好的语句。二,。在散列之前，您不需要删除斜杠和真正的转义。一旦你对字符串进行散列，斜杠和'无论如何都会消失。在测试更改为mysqli后，整个登录系统崩溃，除此之外，删除真正的escape和stripslashes也没什么作用。我需要把每个文件都转换成mysqli吗？我没说这能解决问题。这些只是建议。为什么？因为在像…这样的SQL中注入值是不安全的，即使在使用stripslashes和real escape之后，它们也不是完美的，所以更好的方法是在准备好的语句中使用mysqli_uu，但这不是一些简单的转换；要让它发挥作用需要时间。在任何情况下，我想你的问题可能很简单，更新失败了…你试过用旧密码登录吗？也许什么都没有更新过。