用户验证密码检查数据库
我正在开发一个需要用户进行身份验证的应用程序。我通过拥有一个包含配置文件表并在表内包含用户名和密码的数据库来做到这一点。我打算让用户输入他们的用户名和密码，然后将他们给定的数据与数据库中的数据进行比较。如果它们相同，那么它们就会登录。这是执行此操作的正确方法吗？
如果这是正确的方法，我如何将用户给定的密码与数据库中的密码进行比较？数据库中的密码是使用 PASSWORD 函数加密的。
谢谢！
I am working on an application that requires user to authenticate. I am doing this by having a database that has a profile table and has inside the table a username and password. I was going to have the user input their username and password and then compare their given data against the data in the database. And if they were the same, then they are logged in. Is this the correct way to do this?
If this is the correct way to do this, how do i compare the user's given password to the password in the database? The password in the database was encrypted using the PASSWORD function.
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您可以为此使用 AES_ENCRYPT()、AES_DECRYPT() 函数。这是我建议的方式。在您的程序中，您保留一个存储加密密钥的常量全局变量。
所以你可以像这样比较密码。
SELECT User_ID FROM profile where profile.userID= ' + userID + ' AND profile.password = AES_ENCRYPT(' + Givepassword + ','" + USER_ENCRYPTION_KEY + "')
希望这会对您有所帮助。
普拉萨德。
You can use AES_ENCRYPT(), AES_DECRYPT() functions for this. Here the way I propose. In your program you keep a constant global variable which stored the encryption key.
So you can compare the password like this.
SELECT User_ID FROM profile where profile.userID= ' + userID + ' AND profile.password = AES_ENCRYPT(' + givenpassword + ','" + USER_ENCRYPTION_KEY + "')
Hope this will help you.
Prasad.
你有基础知识，是的。
通常在密码中添加 salt 到密码中，然后使用一-方式哈希算法，例如 SHA1()、SHA256() 等。然后存储用户名，数据库中的盐和散列密码+盐。
验证凭据时，您根据用户名检索盐，然后使用它对提供的密码进行哈希处理，然后将其与您存储的密码进行比较。对用户的失败响应不应表明密码或用户名是否错误。只是有些事情是不正确的。
盐可以防止字典攻击。单向哈希可防止任何人（包括您或用户）检索密码。你只能重置它。
这绝不是一份全面的指南。只是一些更多的建议，让你们更接近。
You have the basics, yes.
It's customary to add a salt to the password and then hash it using a one-way hashing algorithm such as SHA1(), SHA256() etc. Then store the username, the salt and the hashed password+salt in your db.
When verifying the the credentials you retrieve the salt based on the username, then use it to hash the provided password, then compare it to the one you have stored. A failed response to the user should not indicate whether the password or the username was wrong. Just that SOMETHING was incorrect.
The salt prevents dictionary attacks. The one-way hash prevents anyone, including you or the user, from ever being able to retrieve the password. You can only reset it.
This is by no means a comprehensive guide. Just some more suggestions to get you closer.