如何通过 PHP/MySQL/JSON 将 bcrypt 用于用户数据 - How to use bcrypt for user data with PHP/MySQL/JSON

我目前正在开发一个Android应用程序，并使用PHP/MySQL/JSON进行用户注册和登录过程。现在我想使用 bcyrpt 对用户数据进行哈希处理。我是PHP的新手，阅读了很多散列教程，但我没有找到任何适合我的PHP skript的教程。我尝试了 password_hash（）函数，但它不起作用。

你能给我建议如何在我的文件中使用 bcrypt 吗？

这些是我的PHP文件：

<?php
require("config.inc.php");
if (!empty($_POST)) {
    $query = " 
            SELECT 
                id, 
                username, 
                password
            FROM users 
            WHERE 
                username = :username 
        ";
    $query_params = array(
        ':username' => $_POST['username']
    );
    try {
        $stmt   = $db->prepare($query);
        $result = $stmt->execute($query_params);
    }
    catch (PDOException $ex) {
        $response["success"] = 0;
        $response["message"] = "Database Error1. Please Try Again!";
        die(json_encode($response));
    }
    $validated_info = false;
    $row = $stmt->fetch();
    if ($row) {
        if ($_POST['password'] === $row['password']) {
            $login_ok = true;
        }
    }
    if ($login_ok) {
        $response["success"] = 1;
        $response["message"] = "Login successful!";
        die(json_encode($response));
    } else {
        $response["success"] = 0;
        $response["message"] = "Invalid Credentials!";
        die(json_encode($response));
    }
} else {
?>
        <h1>Login</h1> 
        <form action="login.php" method="post"> 
            Username:<br /> 
            <input type="text" name="username" placeholder="username" /> 
            <br /><br /> 
            Password:<br /> 
            <input type="password" name="password" placeholder="password" value="" /> 
            <br /><br /> 
            <input type="submit" value="Login" /> 
        </form> 
        <a href="register.php">Register</a>
    <?php
}
?>

<?php
    require("config.inc.php");
    if (!empty($_POST)) {
        if (empty($_POST['username']) || empty($_POST['password'])) {
            $response["success"] = 0;
            $response["message"] = "Please Enter Both a Username and Password.";
            die(json_encode($response));
        }
        $query        = " SELECT 1 FROM users WHERE username = :user";
        $query_params = array(
            ':user' => $_POST['username']
        );
        try {
            $stmt   = $db->prepare($query);
            $result = $stmt->execute($query_params);
        }
        catch (PDOException $ex) {
            $response["success"] = 0;
            $response["message"] = "Database Error1. Please Try Again!";
            die(json_encode($response));
        }
        $row = $stmt->fetch();
        if ($row) {
            $response["success"] = 0;
            $response["message"] = "I'm sorry, this username is already in use";
            die(json_encode($response));
        }
        $query = "INSERT INTO users ( username, password ) VALUES ( :user, :pass ) ";
        $query_params = array(
            ':user' => $_POST['username'],
            ':pass' => $_POST['password']
        );
        try {
            $stmt   = $db->prepare($query);
            $result = $stmt->execute($query_params);
        }
        catch (PDOException $ex) {
            $response["success"] = 0;
            $response["message"] = "Database Error2. Please Try Again!";
            die(json_encode($response));
        }
        $response["success"] = 1;
        $response["message"] = "Username Successfully Added!";
        echo json_encode($response);
    } else {
    ?>
        <h1>Register</h1> 
        <form action="register.php" method="post"> 
            Username:<br /> 
            <input type="text" name="username" value="" /> 
            <br /><br /> 
            Password:<br /> 
            <input type="password" name="password" value="" /> 
            <br /><br /> 
            <input type="submit" value="Register New User" /> 
        </form>
        <?php
    }

    ?>

在寄存器脚本中，不应直接存储密码，而应调用 password_hash（）函数并存储其结果：

// Hash a new password for storing in the database.
// The function automatically generates a cryptographically safe salt.
$hashToStoreInDb = password_hash($_POST['password'], PASSWORD_DEFAULT);

在登录脚本中，您可以像以前一样从数据库中获取密码哈希，但您必须调用 password_verify（）函数，而不是将其与输入的密码进行比较：

// Check if the hash of the entered login password, matches the stored hash.
// The salt and the cost factor will be extracted from $existingHashFromDb.
$isPasswordCorrect = password_verify($_POST['password'], $existingHashFromDb);