需要帮助...如何将 md5 添加到 php 中的密码字段？

Question

我在这里寻求一些帮助和很好的关注..

我很多年前购买了一些php脚本，现在不再支持了...我只想将md5添加到密码字段..

这里是我的表单：

<?php
$SQL = "SELECT * from USERS WHERE USERNAME = '$_SESSION[username]'"; $result = @mysql_query( $SQL ); $row = @mysql_fetch_array( $result );

include 'menu.php';
?>
<FORM METHOD="post" ACTION="?page=query_client">
 <INPUT TYPE="hidden" NAME="controller" VALUE="USERS~update~account_details&up=1~<?php echo $row[ID]; ?>">

 <TABLE CLASS="basictable">
  <TR> 
   <TD CLASS="tdmenu"  WIDTH="40%">Username</TD>
   <TD CLASS="tdmenu"  WIDTH="60%"> 
    <b><?php echo $row[USERNAME]; ?></b>
   </TD>
  </TR>
  <TR> 
   <TD CLASS="tdmenu"  WIDTH="40%">Password *</TD>
   <TD CLASS="tdmenu"  WIDTH="60%"> 
    <INPUT TYPE="PASSWORD" NAME="PASSWORD" SIZE="40" VALUE="<?php echo $row[PASSWORD]; ?>">
   </TD>
  </TR>
  <TR> 
   <TD CLASS="tdmenu"  WIDTH="40%">Email Address *</TD>
   <TD CLASS="tdmenu"  WIDTH="60%"> 
    <INPUT TYPE="text" NAME="EMAIL" SIZE="40" VALUE="<?php echo $row[EMAIL]; ?>">
   </TD>
  </TR>
  <TR> 
   <TD CLASS="tdmenu"  WIDTH="40%">Full Name *</TD>
   <TD CLASS="tdmenu"  WIDTH="60%"> 
    <INPUT TYPE="text" NAME="FULLNAME" SIZE="40" VALUE="<?php echo $row[FULLNAME]; ?>">
   </TD>

  <TR> 
   <TD CLASS="tdmenu"  WIDTH="40%">Address *</TD>
   <TD CLASS="tdmenu"  WIDTH="60%"> 
    <INPUT TYPE="text" NAME="ADDRESS1" SIZE="40" VALUE="<?php echo $row[ADDRESS1]; ?>">
   </TD>
  </TR>

 <BR>
 <TABLE CLASS="basictable">
  <TR> 
   <TD CLASS="tdhead2" > 
    <DIV ALIGN="CENTER"><B> 
     <INPUT TYPE="submit" NAME="Submit" VALUE="Submit">
     </B></DIV>
   </TD>
  </TR>
 </TABLE>
</FORM>

和

它本身就像 query_client.php 里面的样子：

<?PHP
@session_start();

$controller = $_POST['controller'];
$pieces = explode("~", $controller);
$table = $pieces[0];
$qt =  $pieces[1];
$return =  $pieces[2];
$id =  $pieces[3];
$hack =  $pieces[4];

if ($qt == insert) $qt = 'INSERT INTO';
if ($qt == update) { $qt = 'UPDATE'; $end = "WHERE ID = '$id'"; }
$pre = array_keys( $_POST );

mysql_query ("CREATE TABLE IF NOT EXISTS `$table` (`ID` INT NOT NULL AUTO_INCREMENT , PRIMARY KEY ( `id` ) )");

$count = count($pre); $count = $count - 2;
$sql = "$qt $table SET";
for ($i=0; $i < $count; $i++)
{
$x=$i+1;
$y = $_POST[$pre[$x]];
$d = $y;
mysql_query ("ALTER TABLE `$table` ADD `$pre[$x]` TEXT NOT NULL");
$sql .= " `$pre[$x]` = '$d',";
}
$sql .= " ID = '$id' $end";
$query = mysql_query($sql) or die("$sql_error" . mysql_error());

if (empty($hack)) { } else {
$pieces = explode("/", $hack);
$h0 = $pieces[0];
$h1 = $pieces[1];
$h2 = $pieces[2];
$h3 = $pieces[3];
$h4 = $pieces[4];
$h5 = $pieces[5];

mysql_query ("ALTER TABLE `$table` $h0 $h1 $h2 $h3 $h4 $h5");
$query = mysql_query($sql) or die("$sql_error" . mysql_error());
}

if (isset($_GET[inc])) include "$_GET[inc].php";

?>

所以请帮助我如何在 PASSWORD 字段中添加 md5？ 提前致谢..

Answer 1

最好也使用盐 - 散列和验证应该在服务器上完成 - 请参阅 安全PHP 的哈希和盐

有关编写安全代码的一些链接：

• OWASP Top 10 for 2010
• PHP 安全：强化您的网站
• 编写安全的 PHP