php 解密使用mysql的PASSWORD()函数加密的密码
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/25138242/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Decryption of password encrypted using PASSWORD() function of mysql
提问by Tripathi29
I am usingPASSWORD()function of SQL for encrypting passwords . Now i am searching for a way to get the password if someone forget his/her password.
我正在使用PASSWORD()SQL 函数来加密密码。现在我正在寻找一种在有人忘记密码时获取密码的方法。
$user = "select * from users where email='$email' and password='PASSWORD($pass)'";
Thanks
谢谢
回答by Erik Terwan
You should never store your passwords in a way that they can be decrypted. Instead just generate a new password.
您永远不应该以可以解密的方式存储您的密码。而只是生成一个新密码。
Something like:
就像是：
UPDATE users SET `password` = 'PASSWORD(someSuper.Safe123Password!)' WHERE `id` = USERID
回答by Sander Visser
PASSWORD()is a hashing method and therefor it can't be decrypted to the orginal string
http://dev.mysql.com/doc/refman/5.1/en/password-hashing.html
PASSWORD()是一种散列方法，因此无法解密为原始字符串
http://dev.mysql.com/doc/refman/5.1/en/password-hashing.html
So the answer to your question
所以你的问题的答案
If you want to encrypt/decrypt you can use the AES_ENCRYPTand AES_DECRYPTmethods
http://dev.mysql.com/doc/refman/5.5/en/encryption-functions.html#function_aes-decryptOr the DES_ENCRYPTand DES_DECRYPT
如果你想加密/解密你可以使用AES_ENCRYPT和AES_DECRYPT方法
http://dev.mysql.com/doc/refman/5.5/en/encryption-functions.html#function_aes-decrypt或者DES_ENCRYPT和DES_DECRYPT
NOTE: It's not wise to store passwords that can be decrypted for security reasons, you could better set a new password. Or in your case when a user forgets his/her password you can generated a random string and use that as password in your database the generated password could be mailed to your end-user.
注意：出于安全原因存储可以解密的密码是不明智的，您最好设置一个新密码。或者在您的情况下，当用户忘记他/她的密码时，您可以生成一个随机字符串并将其用作数据库中的密码，生成的密码可以邮寄给您的最终用户。
As noted by hd you could better use the generated string as reset token for your end-users.
正如 hd 所指出的，您可以更好地将生成的字符串用作最终用户的重置令牌。
回答by jMoshayem
You cant recover this password in direct way, only you can use brute-force attack or using rainbow tables for this hashes.
您无法直接恢复此密码，只能使用蛮力攻击或使用彩虹表来获取此哈希值。
Or if you dont want to recover it you can change it via update command from mysql.
或者，如果您不想恢复它，您可以通过 mysql 的更新命令更改它。
