PHP密码验证在MySQLi中无法正常工作[重复]

Question

此问题已经在这里有了答案：

• PHP password_hash(), password_verify()2个答案
• mysqli_fetch_assoc() expects parameter / Call to a member function bind_param() errors. How to get the actual mysql error and fix it?1个答案
• Reference - What does this error mean in PHP?34个答案

我能够像这样散列并验证密码

<?php
    $password ="passss.com";
    $hash = password_hash($password, PASSWORD_DEFAULT);
    if (password_verify('passss.com', $hash)) {
         echo 'Password is valid!';
    } else {
      echo 'Invalid password.';
    }
?>

但是当我试图在从MySQL查询数据中做同样的事情时，我总是得到Invalid password

我只是在PHP文件中创建了$hash，然后将其手动插入到MySQL表中。

if (!isset($_POST['username'], $_POST['password'])) {
    die('Please fill both the username and password field!');
}
if ($stmt = $con->prepare('SELECT id, userpassword FROM users WHERE useremail = ?')) {
    $stmt->bind_param('s', $_POST['username']);
    $stmt->execute();
    $stmt->store_result();
    if ($stmt->num_rows > 0) {
        $stmt->bind_result($id, $userpassword);
        $stmt->fetch();
        if (password_verify($_POST['password'], $userpassword)) {
            $_SESSION['loggedin'] = true;
            echo "Password is valid";
        } else {
            echo "Invalid password.";
        }
    } else {
        echo 'Incorrect username!';
    }
}

Answer 1

您确定您使用php构建函数正确地对密码进行了哈希处理。像

$password=$_POST['password'];
$options = array("cost"=>4);
$hashPassword = password_hash($password,PASSWORD_BCRYPT,$options);

//在这里传递$ hashPassword并插入数据库

我已经在下面的链接中回答了这个问题，您可以在该链接中学习注册，验证密码哈希然后登录

What are the best practices for password submission?