使用bcrypt密码-忘记密码的电子邮件


Using bcrypt for passwords- forgotten password email

我最近为用户密码实现了bcrypt。我已经设法在用户注册时将密码进行散列,他们可以通过相互比较,使用注册的密码(而不是散列版本)登录到自己的帐户。我的问题是,我正在处理一个忘记密码的电子邮件页面,该页面向用户发送一封声明密码的电子邮件,无论它发送的是哈希版本。有没有办法绕过这一点,我可以陈述旧的观点,或者这是不可能的?我知道这不是很安全,但这只是我正在完成的一个小的个人项目,还没有上线。

这是我放弃的.php

<?php
if (isset($_POST['email'])){
$email = $_POST['email'];
$sql="select * from user where email='$email'";
$result   = mysqli_query($mysqli_conn, $sql);
$count=mysqli_num_rows($result);
if($count==1)
{
    $rows=mysqli_fetch_array($result);
    $pass  =  $rows['password'];//FETCHING PASS
    //echo "your pass is ::".($pass)."";
    $to = $rows['email'];
    //echo "your email is ::".$email;
    //Details for sending E-mail
    $from = "Website";
    $url = "www.website.com";
    $body  =  "Password recovery
    -----------------------------------------------
    Url : $url;
    <br> Your email details: $to;
    <br>Here is your password  : $pass;
    <br><br>Sincerely,
    Find-a-room";
    $from = "myemail@email.com";
    $subject = "Password recovered";
    $headers1 = "From: $from'n";
    $headers1 .= "Content-type: text/html;charset=iso-8859-1'r'n";
    $headers1 .= "X-Priority: 1'r'n";
    $headers1 .= "X-MSMail-Priority: High'r'n";
    $headers1 .= "X-Mailer: Just My Server'r'n";
    $sentmail = mail ( $to, $subject, $body, $headers1 );
   } else {
if ($_POST ['email'] != "") {
echo "<span> Not found your email in our database</span>";
    }
    }

if($sentmail==1)
{
    echo "<span style='color: #ff0000;'> Your Password Has Been Sent To Your 
Email Address.</span>";
}
    else
    {
    if($_POST['email']!="")
    echo "<span style='color: #ff0000;'> Cannot send password to your e-mail 
address.Problem with sending mail...</span>";
}
}
?>
<form action="" method="post">
    <label> Enter your User ID : </label>
    <input id="email" type="text" name="email" />
    <input id="button" type="submit" name="button" value="Submit" />
</form>

哈希使用单向算法,所以你不能这样做,我也不建议用纯文本发送密码。