php – Blowfish加密 – 哈希已创建,但不会验证

当注册第一个passwordEncrypt()函数时,下面运行2个函数.

当尝试登录时,调用checkPassword()函数,而不是登录并回显“是”,它将进入回声“否”的部分.

所以,如果一双新鲜的眼睛可以提前看到许多感谢！

// Encrypt user password
function passwordEncrypt($password) {
    // set the salt
    $salt = substr(md5(time()),22);

    // encrypt using blowfish with a load of 10
    $password = crypt($password,'$2a$10$' . $salt);

    // return the encrypted hash
    return $password;
}

/*
    Check password function when logging in
    first we select the password from the supplied username from the database
    // get the row and set the hash to the currect password from the database
    //run the salts etc and check to see if the passwords match
*/
function checkPassword($userName,$password,$db){
    $sql = 'SELECT password FROM users WHERE userName = :userName';
    $stmt = $db->prepare($sql);
    $stmt->bindValue(':userName',$userName,PDO::PARAM_STR);
    $stmt->execute();

    $numRows = $stmt->rowCount();

    if ($numRows > 0) {
        $row = $stmt->fetch();
        $hash = $row['password'];

        // run the hash function on $password?
        $fullSalt = substr($hash,29); 
        $new_hash = crypt($password,$fullSalt); 

        // Check that the password matches
        if($hash == $new_hash) {
            echo 'yes';
            exit;
            return true;
        } else {
            echo 'no';
            exit;
            return false;
        }
    } else {
        echo 'way';
        exit;
        return false;
    }
}

我已经注册了密码,然后尝试了,这就是它返回的内容

密码：$2A $10 $023d3086e8462207a1fecueWH4Ub40MWbQJ7F9
输入：$2a $10 $023d3086e8462207a1fecueWH4Ub40MWbQJ7F9hapWU3lYxlg3AAa
没有

因此它增加了hapWU3lYxlg3AAa