PHPログインシステム

Question

私は自分のウェブサイトのログインシステムを作成していますが、それほど大したことはありません。私は$pw = password_hash($pw, PASSWORD_BCRYPT, array('cost' => 14));のようなパスワードをハッシュしています。私はログインシートのパスワードを確認するためにpassword_verifyを使用しなければならないと言われましたが、もう一度チェックしますが、私は何をしなければならないのか分かりません。誰かが何をしなければならないかを一歩一歩説明してもらえますか？

GLOBAL $username; 
GLOBAL $pw; 

if (empty($_POST["username"])) { 
       echo"fill in username to sign in"; 
       } else { 

       if (empty($_POST["pw"])) { 
       echo"fill in password to sign in"; 
       } else { 

//check if form is submitted 
if (isset($_POST['signin'])) { 

$username = mysqli_real_escape_string($conn, $_POST['username']); 
$pw = mysqli_real_escape_string($conn, $_POST['pw']); 

$valid = password_validate($password, $hash); 

$sql = mysqli_query($conn, "SELECT * FROM users WHERE username = '" . $username. "' and pw = '" . $pw. "'"); 

if ($row = mysqli_fetch_array($sql)) { 

     // if insert checked as successful echo username and password saved successfully 
     echo "successfully logged in"; 

} else { 
    $errormsg = "Incorrect username or Password!!!"; 
} 
} 
} 
} 

Answer 1

あなたの最初の試みで本当にたくさんのことはありません。ここで

が提案プロセスであるあなたが

<?php  
    //check if form is submitted 
    if ($_SERVER['REQUEST_METHOD'] != 'POST' || 
     ! isset($_POST['signin'])) 
    { 
     // looks like a hack, send to index.php 
     header('Location: index.php'); 
     exit; 
    } 

    if (empty($_POST["username"])) { 
     echo 'fill in username to sign in'; 
    } 
    if (empty($_POST["pw"])) { 
     echo 'fill in password to sign in'; 
    } 

    // dangerous and unnecessary 
    // why would you risk changing the users username and password 

    //$username = mysqli_real_escape_string($conn, $_POST['username']); 
    //$pw = mysqli_real_escape_string($conn, $_POST['pw']); 

    // function does not exist 
    //$valid = password_validate($password, $hash); 


    // dangerous (SQL Injection) 
    // Wont work as you are using pw in the criteria and you dont know what pw is as it is a hash 
    //$sql = mysqli_query($conn, "SELECT * FROM users WHERE username = '" . $username. "' and pw = '" . $pw. "'"); 

    // you must select the password using only the username 
    // as the selection criteria 
    // also as the username was passed from the page its potentially 
    // dangerous so use a parameterized query 
    $sql = "SELECT pw FROM user WHERE username = ?"; 

    $stmt = mysqli_prepare($sql); 
    if (!$stmt) { 
     echo mysqli_error($conn); 
     exit; 
    } 

    $stmt->bind_param('s', $_POST['pw']); 
    $stmt->execute(); 

    if (!$stmt) { 
     echo mysqli_error($conn); 
     exit; 
    } 
    // we found a row with that username, 
    // now we need to check the password is correct 

    // get the password from the row 
    $stmt->bind_result($hashed_pwd); 
    $stmt->fetch(); 

    if (password_verify($_POST['pw'], $hashed_pwd)) { 
     // password verified 
     echo 'Login is valid'; 
    } else { 
     echo 'Incorrect username or Password!!!'; 
    } 
} 
?>