php 如何在我的 sql 数据库中使用 md5() 函数
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/13643083/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
how to use md5() function with my sql database
提问by surisava
my problem is solved. I don't expect for more answers. So, please don't vote down, cause I need some reputations to vote up for others post. Thanks
我的问题解决了。我不期望有更多的答案。所以，请不要投反对票，因为我需要一些声誉来为其他帖子投赞成票。谢谢
I try to use md5()for the login system but it doesn't encrypt password. It still display the original password on my database. Here is my code:
我尝试md5()用于登录系统，但它不加密密码。它仍然在我的数据库中显示原始密码。这是我的代码：
mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");
$myusername=$_POST['myusername'];
$mypassword=md5($_POST['mypassword']);
$sql="select * from $tbl_name where username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);
$count=mysql_num_rows($result);
if($count==1){
session_register("myusername");
session_register("mypassword");
header("location:login_success.php");
}
else {
header("location:login.html");
}
?>
I just edit my code to $mypassword=md5($_POST['mypassword']);
我只是编辑我的代码 $mypassword=md5($_POST['mypassword']);
回答by arun
You just printed the md5d password, store it into the variable before insertion
您刚刚打印了 md5d 密码，在插入之前将其存储到变量中
$mypassword = md5($_POST['mypassword']);
$sql="select * from $tbl_name where username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);
I think your logic have some problem, are you storing passwords in encrypted form? then only you can fetch the data by this select command, otherwise the $count=mysql_num_rows($result);is zero always
我认为您的逻辑有问题，您是否以加密形式存储密码？那么只有您可以通过此选择命令获取数据，否则$count=mysql_num_rows($result);始终为零
and please take a look here also
也请看这里
回答by som
SELECT MD5('testing');
For example
例如
$sql="select * from $tbl_name where username='$myusername' and password=MD5($mypassword)";
In your sql
在你的 sql
回答by martinstoeckli
Storing unsalted MD5 hashes of passwords, is almost the same as storing them plaintext. With off-the-shelf hardware, one can try 8 Giga passwords per second, that means you can brute-force a whole dictionary with about 500'000 words in less than a millisecond!
存储未加盐的密码 MD5 哈希值几乎与存储明文相同。使用现成的硬件，人们每秒可以尝试 8 个 Giga 密码，这意味着您可以在不到一毫秒的时间内暴力破解大约 500,000 个单词的整个字典！
Even more, there are tons of precalculated hash-tables for MD5 without salt, so just take an MD5 hash of your own password, type it into google and see what the original password was, or maybe it's better not to do it...
更重要的是，没有盐的 MD5 有大量预先计算的哈希表，所以只需获取您自己密码的 MD5 哈希，将其输入谷歌并查看原始密码是什么，或者最好不要这样做......
That's why one should use a slow key-derivation function like BCryptnowadays. PHP 5.5 will have it's own functions password_hash()and password_verify()ready, to simplify this task. There is a compatibility packfor PHP 5.3/5.4 available, downloadable at password_compat.
这就是为什么现在应该使用像BCrypt这样的慢速密钥派生函数。PHP 5.5 将拥有自己的功能password_hash()并password_verify()准备就绪，以简化此任务。有适用于 PHP 5.3/5.4的兼容包，可在password_compat下载。
I would invite you to ready more about correctly hashing passwords in this tutorial.
我会邀请您在本教程中准备更多有关正确散列密码的信息。
回答by vlcekmi3
now you just echoing encrypted password to output:
现在您只需回显加密密码即可输出：
echo md5($mypassword);
what you want is assign to the $mypassword
你想要的是分配给 $mypassword
$mypassword = md5($mypassword);
回答by Jon Cairns
You MUST escape your strings, to block SQL injections. At the very least use mysql_real_escape_string(). And don't use MD5, use Sha1:
您必须转义您的字符串，以阻止 SQL 注入。至少使用mysql_real_escape_string(). 并且不要使用 MD5，使用 Sha1：
$mypassword = sha1($_POST['mypassword']);
$myusername = mysql_real_escape_string($_POST['myusername']);
$sql="select * from $tbl_name where username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);
回答by Toretto
I would recomend you to use mysqlior PDO.You just printed the md5d password, you need to store it value to particular variable and use that variable in to your query.To do it try this
我建议您使用mysqli或PDO。您刚刚打印了 md5d 密码，您需要将其值存储到特定变量并将该变量用于您的查询中。要做到这一点，请尝试这个
<?php
mysql_connect("$host", "$username", "$password") or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");
$myusername=$_POST['myusername'];
$mypassword=$_POST['mypassword'];
$newpassword = md5($mypassword);
$sql="select * from $tbl_name where username='".$myusername."' and password='".$mypassword."'";
$result=mysql_query($sql);
$count=mysql_num_rows($result);
if($count==1)
{
session_register("myusername");
session_register("mypassword");
header("location:login_success.php");
}
else {
header("location:login.html");
}
?>
