php password_详谈PHP中的密码安全性Password Hashing

如果你还在用md5加密，建议看看下方密码加密和验证方式。

先看一个简单的Password Hashing例子：

//require 'password.php';

/**

* 正确的密码是secret-password

* $passwordHash 是hash 后存储的密码

* password_verify()用于将用户输入的密码和数据库存储的密码比对。成功返回true，否则false

*/

$passwordHash = password_hash('secret-password', PASSWORD_DEFAULT);

echo $passwordHash;

if (password_verify('bad-password', $passwordHash)) {

// Correct Password

echo 'Correct Password';

} else {

echo 'Wrong password';

// Wrong password

}

下方代码提供了一个完整的模拟的 User 类，在这个类中，通过使用Password Hashing，既能安全地处理用户的密码，又能支持未来不断变化的安全需求。

class User

{

// Store password options so that rehash & hash can share them:

const HASH = PASSWORD_DEFAULT;

const COST = 14;//可以确定该算法应多复杂，进而确定生成哈希值将花费多长时间。(将此值视为更改算法本身重新运行的次数，以减缓计算。)

// Internal data storage about the user:

public $data;

// Mock constructor:

public function __construct() {

// Read data from the database, storing it into $data such as:

// $data->passwordHash and $data->username

$this->data = new stdClass();

$this->data->passwordHash = 'dbd014125a4bad51db85f27279f1040a';

}

// Mock save functionality

public function save() {

// Store the data from $data back into the database

}

// Allow for changing a new password:

public function setPassword($password) {

$this->data->passwordHash = password_hash($password, self::HASH, ['cost' => self::COST]);

}

// Logic for logging a user in:

public function login($password) {

// First see if they gave the right password:

echo "Login: ", $this->data->passwordHash, "\n";

if (password_verify($password, $this->data->passwordHash)) {

// Success - Now see if their password needs rehashed

if (password_needs_rehash($this->data->passwordHash, self::HASH, ['cost' => self::COST])) {

// We need to rehash the password, and save it. Just call setPassword

$this->setPassword($password);

$this->save();

}

return true; // Or do what you need to mark the user as logged in.

}

return false;

}

}

以上这篇详谈PHP中的密码安全性Password Hashing就是小编分享给大家的全部内容了，希望能给大家一个参考，也希望大家多多支持脚本之家。