password_hash 每次返回不同的值

2021-12-27 00:00:00 hash passwords php php-password-hash

我正在制作一个登录系统，我想对密码进行散列以使其更安全，但它每次都返回不同的散列，甚至无法使用 password_verify() 进行验证，这是我的代码:

I'm making a login system, and I want to hash the passwords to make them more secure, but it returns a different hash every time, and can't even be verified using password_verify(), here is my code:

$password = password_hash($password4, PASSWORD_DEFAULT);

这是我的验证代码:

if(password_verify($password4, $dbpassword))

推荐答案

所以让我们一次一个部分

So let's take it one part at a time

但它每次都返回不同的哈希

but it returns a different hash every time

就是这个想法.password_hash 旨在每次生成随机盐.这意味着您必须单独分解每个散列，而不是猜测用于所有内容的一种盐并获得巨大优势.

That's the idea. password_hash is designed to generate a random salt every time. This means you have to break each hash individually instead of guessing one salt used for everything and having a huge leg up.

无需MD5 或进行任何其他散列.如果你想提高 password_hash 的安全性，你可以通过更高的成本(默认成本是 10)

There's no need to MD5 or do any other hashing. If you want to raise the security of password_hash you pass a higher cost (default cost is 10)

$password = password_hash($password4, PASSWORD_DEFAULT, ['cost' => 15]);

至于验证

if(password_verify($password4, $dbpassword))

所以 $password4 应该是你未散列的密码，$dbpassword 应该是你存储在数据库中的哈希

So $password4 should be your unhashed password and $dbpassword should be the hash you've stored in your database

相关文章