(PHP) 如何正确实现 crypt()
以下是 php crypt() 手册页中的示例：
<?php
$password = crypt('mypassword'); // let the salt be automatically generated
/* You should pass the entire results of crypt() as the salt for comparing a
password, to avoid problems when different hashing algorithms are used. (As
it says above, standard DES-based password hashing uses a 2-character salt,
but MD5-based hashing uses 12.) */
if (crypt($user_input, $password) == $password) {
echo "Password verified!";
}
?>
为什么会这样工作？我认为 'mypassword' 是我希望实际管理员使用的密码。所以我首先对其进行加密，并将其设置为等于$password。显然，我必须将其存储在数据库中。但在接下来的几行中，它被用作盐和我要比较的内容，并且我不明白 crypt($user_input, $password) 如何可能等于 $password，如果在后一种情况下，理想情况下我有正确的密码作为 $user_input 但用 $password 与 $password 进行比较代码>. 对我来说会更有意义？
if (crypt($user_input) == $password) {
echo "Password verified!";
}
如果最后一行是我不明白什么，
Here is the example from the PHP manual page for crypt():
<?php
$password = crypt('mypassword'); // let the salt be automatically generated
/* You should pass the entire results of crypt() as the salt for comparing a
password, to avoid problems when different hashing algorithms are used. (As
it says above, standard DES-based password hashing uses a 2-character salt,
but MD5-based hashing uses 12.) */
if (crypt($user_input, $password) == $password) {
echo "Password verified!";
}
?>
Why does this work? I take it 'mypassword' is the password I want the actual admin to use. So I crypt that first, and set it equal to $password. Obviously, I must need to store that in the DB. But in the next lines it's being used as both the salt and what I'm comparing to, and I don't understand how crypt($user_input, $password) can possibly be equal to $password, if in this latter case I have ideally the right password as $user_input but salted with $password being compared to $password. It would make more sense to me if the last line were
if (crypt($user_input) == $password) {
echo "Password verified!";
}
What am I not understanding?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
crypt是一个单向函数，返回一个已包含盐的字符串。输出与/etc/shadow中存储的内容类似。来自 php.net 的示例：
将用户输入与crypt 结果，该函数自动从字符串中提取盐。
cryptis a one-way function and returns a string that already contains the salt. The output is similar to what is stored in/etc/shadow.Example from php.net:
When comparing the user input with the crypt result, the function automatically extracts the salt from the string.