让我重新表述一下我的最后问题，我可以使用什么 PHP 库或框架用于专业且安全的身份验证？如果您的想法有助于实现帐户控制面板功能（更改密码、编辑个人资料），则可加分。
高手们是如何做到的呢？您曾经使用 PHP 进行过值得信赖的身份验证吗？
Let me rephrase my last question, what PHP library or framework can I use for professional and secure authentication? Extra points if your idea helps implement account Control Panel features (change password, edit profile).
How do you pros do it? Have you ever done trustworthy authentication using PHP?
发布评论
评论（4）
我个人非常喜欢 symfony 框架及其 sfGuard 插件。它提供了非常容易配置的身份验证。它对所有密码进行散列和盐处理，并提供后端界面来管理用户、组和权限。
Symfonys 路由和配置使得在每个页面甚至网站“区域”上设置安全标志变得非常简单。在构建安全网站时，我无需寻找其他地方。
I personally really like the symfony framework and its sfGuard plugin. It provides very easy to configure authentication. It hashes and salts all the passwords and provides a backend interface to manage users, groups and permissions.
Symfonys routing and configuration makes it very simple to set a secure flag on every page or even "area" of your web site. I have had no need to look elsewhere when building a secure web site.
我开发的一个高级身份验证库是ulogin.sourceforge.net。它支持“记住我”、各种强力预防方法，还可以保护您的会话免受劫持/固定/重放。它还支持多个用户数据库，如 sql/ldap 等。如果您没有使用像 Cake/CI 这样的 PHP 框架，我真诚地推荐它。
An advanced authentication library I have developed is ulogin.sourceforge.net. It has support for remember-me, various brute force prevention methods and also secures your sessions against hijacking/fixation/replay. It also supports multiple user databases like sql/ldap etc. If you are not using a PHP framework like Cake/CI, I honestly recommend it.
您检查过 Drupal 吗？它通过 ssl 提供身份验证，并且不会将密码以明文形式存储在数据库中。它的“控制面板”功能非常好。
Have you checked out Drupal? It provides authentication over ssl and it doesn't store passwords as plaintext in the database. And a it's "Control Panel" features are pretty good.
ESAPI 有一个您可以使用的通用框架，它将需要进行一些重新布线，但它对于您正在寻找的东西来说是可靠的。当然，通过 SSL 进行身份验证，不要在客户端上存储身份验证信息等
ESAPI has a general framework that you can use, it will take a little bit of rewiring but it is solid for what you are looking for. And of course, authenticate over SSL, don't store auth information on the client, etc