Home Backend Development PHP Tutorial Detailed explanation of several ways PHP handles passwords

Detailed explanation of several ways PHP handles passwords

Jan 16, 2017 pm 03:26 PM

在我们的日常开发中,经常会对我们的密码进行加密,对于很多PHP开发者在最先接触PHP的时候,处理密码的首选加密函数可能就是MD5了,我当时就是这样的:

$password = md5($_POST["password"]);
Copy after login

MD5对密码加密的方式是最常见的加密方式,但是现在MD5的加密方式目前已经不太安全了,因为它的加密算法实在是显得有点简单了,而且很多破解密码的站点都存放了很多经过MD5

加密的密码字符串,所以这里我是非常不提倡还在单单使用MD5来加密用户的密码的。

那么除了我们的md5对密码加密,小编今天就给各位看官收集一些PHP中其他的几种加密方式

一. SHA256 和 SHA512

其实跟前面的MD5同期的还有一个SHA1加密方式的,不过也是算法比较简单,所以这里就不介绍了。而这里即将要说到的SHA256 和 SHA512都是来自于SHA2家族的加密函数,看名字

可能你就猜的出来了,这两个加密方式分别生成256和512比特长度的 hash字串。

他们的使用方法如下:

$password = hash("sha256", $password);
Copy after login

PHP内置了hash()函数,你只需要将加密方式传给hash()函数就好了。你可以直接指明sha256, sha512, md5, sha1等加密方式。

二. 盐值

在加密的过程,我们还有一个非常常见的东西:盐值。对,我们在加密的时候其实会给加密的字符串添加一个额外的字符串,以达到提高一定安全的目的,并且盐值要记录下来,方便以后

的比对:

function generateHashWithSalt($password) {
  $intermediateSalt = md5(uniqid(rand(), true));
  $salt = substr($intermediateSalt, 0, 6);
  return hash("sha256", $password . $salt);
}
Copy after login

三. Bcrypt

Bcrypt不失为一种比较不错的加密方式了,但是后面介绍的 Hashing API更好。

function generateHash($password) {
  if (defined("CRYPT_BLOWFISH") && CRYPT_BLOWFISH) {
    $salt = '$2y$11$' . substr(md5(uniqid(rand(), true)), 0, 22);
    return crypt($password, $salt);
  }
}
Copy after login

Bcrypt 其实就是Blowfish和crypt()函数的结合,我们这里通过CRYPT_BLOWFISH判断Blowfish是否可用,然后像上面一样生成一个盐值,不过这里需要注意的是,crypt()的盐值必须以 $2a$ 或者 $2y$ 开头。

四. Password Hashing API

这里才是我们的重头戏,Password Hashing API是PHP 5.5之后才有的新特性,它主要是提供下面几个函数供我们使用:

password_hash()     //对密码加密.
password_verify()    //验证已经加密的密码,检验其hash字串是否一致.
password_needs_rehash() //给密码重新加密.
password_get_info()   //返回加密算法的名称和一些相关信息.
Copy after login

使用这套 API不仅简单,而且更加安全,这也是 PHP官方推荐的加密方式。

$hash = password_hash($passwod, PASSWORD_DEFAULT);

PASSWORD_DEFAULT目前使用的就是Bcrypt加密算法,这里需要注意的是,如果你代码使用的都是PASSWORD_DEFAULT加密方式,那么在数据库的表中,password字段就得设置超

过60个字符长度,你也可以使用PASSWORD_BCRYPT算法,该算法加密后的字符串长度总为60。

这里使用 password_hash()你完全可以不提供盐值(salt)和 消耗值 (cost),你可以将后者理解为一种性能的消耗值,cost越大,加密算法越复杂,消耗的内存也就越大。当然,如果你需要

指定对应的盐值和消耗值,你可以这样写:

$options = [
  'salt' => custom_function_for_salt(), //自定义函数来获得盐值
  'cost' => 12 // the default cost is 10
];
$hash = password_hash($password, PASSWORD_DEFAULT, $options);
Copy after login

不过一般自定义 cost就好了, salt值则使用默认的。

加密好后,只需要简单的使用即可验证密码是否正确

<?php
if (password_verify($password, $hash)) {
  // Pass
}
else {
  // Invalid
}
Copy after login

直接使用password_verify就可以对我们之前加密过的字符串(存在数据库中)进行验证了。

如果要更换更改加密的方式,则必须使用以下代码来重新加密:

if (password_needs_rehash($hash, PASSWORD_DEFAULT, [&#39;cost&#39; => 12])) {
  // cost 变为 12
  $hash = password_hash($password, PASSWORD_DEFAULT, [&#39;cost&#39; => 12]);
 
  // 然后重新保存 hash值
}
Copy after login

只有这样,PHP的 Password Hashing API才会知道我们重现更换了加密方式,这样才能完成之后的密码验证。

password_get_info(),这个函数一般可以看到下面三个信息:

1、algo – 算法实例

2、algoName – 算法名字

3、options – 加密时候的可选参数

以上就是本文的全部内容,希望对大家的学习有所帮助,也希望大家多多支持PHP中文网。

更多好文章,尽在PHP中文网......

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

PHP 8.4 Installation and Upgrade guide for Ubuntu and Debian PHP 8.4 Installation and Upgrade guide for Ubuntu and Debian Dec 24, 2024 pm 04:42 PM

PHP 8.4 brings several new features, security improvements, and performance improvements with healthy amounts of feature deprecations and removals. This guide explains how to install PHP 8.4 or upgrade to PHP 8.4 on Ubuntu, Debian, or their derivati

How To Set Up Visual Studio Code (VS Code) for PHP Development How To Set Up Visual Studio Code (VS Code) for PHP Development Dec 20, 2024 am 11:31 AM

Visual Studio Code, also known as VS Code, is a free source code editor — or integrated development environment (IDE) — available for all major operating systems. With a large collection of extensions for many programming languages, VS Code can be c

Explain JSON Web Tokens (JWT) and their use case in PHP APIs. Explain JSON Web Tokens (JWT) and their use case in PHP APIs. Apr 05, 2025 am 12:04 AM

JWT is an open standard based on JSON, used to securely transmit information between parties, mainly for identity authentication and information exchange. 1. JWT consists of three parts: Header, Payload and Signature. 2. The working principle of JWT includes three steps: generating JWT, verifying JWT and parsing Payload. 3. When using JWT for authentication in PHP, JWT can be generated and verified, and user role and permission information can be included in advanced usage. 4. Common errors include signature verification failure, token expiration, and payload oversized. Debugging skills include using debugging tools and logging. 5. Performance optimization and best practices include using appropriate signature algorithms, setting validity periods reasonably,

PHP Program to Count Vowels in a String PHP Program to Count Vowels in a String Feb 07, 2025 pm 12:12 PM

A string is a sequence of characters, including letters, numbers, and symbols. This tutorial will learn how to calculate the number of vowels in a given string in PHP using different methods. The vowels in English are a, e, i, o, u, and they can be uppercase or lowercase. What is a vowel? Vowels are alphabetic characters that represent a specific pronunciation. There are five vowels in English, including uppercase and lowercase: a, e, i, o, u Example 1 Input: String = "Tutorialspoint" Output: 6 explain The vowels in the string "Tutorialspoint" are u, o, i, a, o, i. There are 6 yuan in total

How do you parse and process HTML/XML in PHP? How do you parse and process HTML/XML in PHP? Feb 07, 2025 am 11:57 AM

This tutorial demonstrates how to efficiently process XML documents using PHP. XML (eXtensible Markup Language) is a versatile text-based markup language designed for both human readability and machine parsing. It's commonly used for data storage an

Explain late static binding in PHP (static::). Explain late static binding in PHP (static::). Apr 03, 2025 am 12:04 AM

Static binding (static::) implements late static binding (LSB) in PHP, allowing calling classes to be referenced in static contexts rather than defining classes. 1) The parsing process is performed at runtime, 2) Look up the call class in the inheritance relationship, 3) It may bring performance overhead.

What are PHP magic methods (__construct, __destruct, __call, __get, __set, etc.) and provide use cases? What are PHP magic methods (__construct, __destruct, __call, __get, __set, etc.) and provide use cases? Apr 03, 2025 am 12:03 AM

What are the magic methods of PHP? PHP's magic methods include: 1.\_\_construct, used to initialize objects; 2.\_\_destruct, used to clean up resources; 3.\_\_call, handle non-existent method calls; 4.\_\_get, implement dynamic attribute access; 5.\_\_set, implement dynamic attribute settings. These methods are automatically called in certain situations, improving code flexibility and efficiency.

What is Cross-Site Request Forgery (CSRF) and how do you implement CSRF protection in PHP? What is Cross-Site Request Forgery (CSRF) and how do you implement CSRF protection in PHP? Apr 07, 2025 am 12:02 AM

In PHP, you can effectively prevent CSRF attacks by using unpredictable tokens. Specific methods include: 1. Generate and embed CSRF tokens in the form; 2. Verify the validity of the token when processing the request.

See all articles