如何创建随机密钥 php mysql？

Question

我需要在 MySQL 中创建随机密钥存储 如果我使用：

<?php echo md5(rand(10000,99999)); ?> 

我可以将其存放在哪里

<?php
require 'config.inc.php';

foreach($_POST as $k=>$v) 
{
    $_POST[$k] = trim($v);
}

if(!isset($_POST['produgg_username']) or !isset($_POST['produgg_password']) or !isset($_POST['produgg_email']))
{
    print "Please use all fields";
}elseif(empty($_POST['produgg_username'])){
    print "Please choose a username";
}elseif(empty($_POST['produgg_password'])){
    print "Please choose a password";
}elseif(empty($_POST['produgg_email'])){
    print "Please enter an email address";
}elseif(!filter_var($_POST['produgg_email'], FILTER_VALIDATE_EMAIL)) {    
    print "Please enter a valid email address";
}elseif(!preg_match("/^[a-z0-9]+$/i", $_POST['produgg_username'])) {
    print "Please use only characters and numbers for username";
}elseif($usersClass->checkUserExists($_POST['produgg_username'])) {
    print "Username Taken, please choose another";
}else{
    if($usersClass->register($_POST['produgg_username'], md5($_POST['produgg_password']), $_POST['produgg_email']))
    {
        print "success";
        $toemail = $_POST['produgg_email'];
        $touser = $_POST['produgg_username'];
        // Send activation email 
         $to = $toemail;
         $subject = "Activation";
         $headers = "From: [email protected]";
         $body = "Howdy $touser! 

         To activate your please click on the following link - http://www..co.uk/activateuser.php?email=$toemail";

        mail($to, $subject, $body, $headers);

    }else{
        print "Something weird happened and we couldn't setup the account!";
    }
}

?>

Answer 1

首先，您似乎正在使用普通的 md5() 来存储用户密码...不要这样做，这是一个安全风险。 您正在将您的用户和您自己置于危险之中。使用更强的哈希算法或 bcrypt 进行密钥强化。 有关详细信息，请参阅此答案。

---

看来您实际上是在尝试生成用于电子邮件激活的nonce。

如果有的话，通用唯一标识符（UUID）将完成这项工作。它的碰撞变化非常低，并允许 3 × 10³⁸ 唯一值（使用某个值后，您可以根据您的用例将其重复用于其他用户）。

您可以使用我编写的这个函数在 PHP 中生成 UUID。您需要的是 v4 UUID。

function UUIDv4() {
  $bytes = str_split(crypto_random_bytes(16));

  // Set UUID Version Number
  $bytes[6] = $bytes[6] & "\x0f" | "\x40";

  // Set UUID DCE1.1 varient
  $bytes[8] = $bytes[8] & "\x3f" | "\x80";

  $uuid = bin2hex(implode($bytes));

  return sprintf('%08s-%04s-%04s-%04s-%12s',
    // 32 bits for "time_low"
    substr($uuid, 0, 8),

    // 16 bits for "time_mid"
    substr($uuid, 8, 4),

    // 16 bits for "time_hi_and_version",
    // four most significant bits holds version number 4
    substr($uuid, 12, 4),

    // 16 bits, 8 bits for "clk_seq_hi_res",
    // 8 bits for "clk_seq_low",
    // two most significant bits holds zero and one for variant DCE1.1
    substr($uuid, 16, 4),

    // 48 bits for "node"
    substr($uuid, 20, 12)
  ); 
}

function crypto_random_bytes($count) {
  static $randomState = null;

  $bytes = '';

  if(function_exists('openssl_random_pseudo_bytes') &&
      (strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN')) { // OpenSSL slow on Win
    $bytes = openssl_random_pseudo_bytes($count);
  }

  if($bytes === '' && is_readable('/dev/urandom') &&
     ($hRand = @fopen('/dev/urandom', 'rb')) !== FALSE) {
    $bytes = fread($hRand, $count);
    fclose($hRand);
  }

  if(strlen($bytes) < $count) {
    $bytes = '';

    if($randomState === null) {
      $randomState = microtime();
      if(function_exists('getmypid')) {
        $randomState .= getmypid();
      }
    }

    for($i = 0; $i < $count; $i += 16) {
      $randomState = md5(microtime() . $randomState);

      if (PHP_VERSION >= '5') {
        $bytes .= md5($randomState, true);
      } else {
        $bytes .= pack('H*', md5($randomState));
      }
    }

    $bytes = substr($bytes, 0, $count);
  }

  return $bytes;
}

Answer 2

使用 uniqid() 函数而不是使用 md5。确保将 more_entropy 设置为 true。

即，

uniqid('prefix', true);

将 'prefix' 更改为适合您的应用程序的内容。