软件开发|编程技术|编程代码|编程入门先学什么—程序设计语言

详谈PHP中的密码安全性Password Hashing

下面小编就为大家带来一篇详谈PHP中的密码安全性Password Hashing。小编觉得挺不错的,现在就分享给大家,也给大家做个参考。一起跟随小编过来看看吧

如果你还在用md5加密,建议看看下方密码加密和验证方式。

先看一个简单的Password Hashing例子:

php//require 'password.php';/** * 正确的密码是secret-password * $passwordHash 是hash 后存储的密码 * password_verify()用于将用户输入的密码和数据库存储的密码比对。成功返回true,否则false */$passwordHash = password_hash('secret-password', PASSWORD_DEFAULT);echo $passwordHash;if (password_verify('bad-password', $passwordHash)) {  // Correct Password  echo 'Correct Password';} else {  echo 'Wrong password';  // Wrong password}

下方代码提供了一个完整的模拟的 User 类,在这个类中,通过使用Password Hashing,既能安全地处理用户的密码,又能支持未来不断变化的安全需求。

phpclass User{  // Store password options so that rehash   const COST = 14;//可以确定该算法应多复杂,进而确定生成哈希值将花费多长时间。(将此值视为更改算法本身重新运行的次数,以减缓计算。)  // Internal data storage about the user:  public $data;  // Mock constructor:  public function __construct() {    // Read data from the database, storing it into $data such as:    // $data-passwordHash and $data-username    $this-data = new stdClass();    $this-data-passwordHash = 'dbd014125a4bad51db85f27279f1040a';  }  // Mock save functionality  public function save() {    // Store the data from $data back into the database  }  // Allow for changing a new password:  public function setPassword($password) {    $this-data-passwordHash = password_hash($password, self::HASH, ['cost' = self::COST]);  }  // Logic for logging a user in:  public function login($password) {    // First see if they gave the right password:    echo "Login: ", $this-data-passwordHash, "\n";    if (password_verify($password, $this-data-passwordHash)) {      // Success - Now see if their password needs rehashed      if (password_needs_rehash($this-data-passwordHash, self::HASH, ['cost' = self::COST])) {        // We need to rehash the password, and save it. Just call setPassword        $this-setPassword($password);        $this-save();      }      return true; // Or do what you need to mark the user as logged in.    }    return false;  }}

以上这篇详谈PHP中的密码安全性Password Hashing就是小编分享给大家的全部内容了,希望能给大家一个参考,也希望大家多多支持脚本之家。