使用MD5进行用户身份验证[关闭]

Question

I'm building an app when i'm able to hash user passwords by using MD5. For the insertion it works correctly, but when i'm authenticating, it tells me the password is wrong

require_once('connect.php');
$data = json_decode(file_get_contents("php://input"));
$email = ($data->email);
$password = ($data->password);

$row = $conn->query("
    SELECT * 
    FROM user 
    WHERE email='".$email."' 
        AND password='".md5.$password."'
");
$row->setFetchMode(PDO::FETCH_ASSOC);

$userdetails = $row->fetchAll();
$user = $row->rowCount();

$error_message=array("message"=>("wrong"));

if ($user == 0) {
    echo json_encode($error_message);
} else {
    session_start();
    $_SESSION['user']=$userdetails;
    echo json_encode($userdetails);
}

Answer 1

Change

$row = $conn->query("SELECT * from user where email='".$email."' and password='".md5.$password."'");

to

$row = $conn->query("SELECT * from user where email='".$email."' and password='".md5($password)."'");

NB : You should use prepared statements and also don't use md5() use password_hash() and password_verify()

Then in your registration page you will have.

$hash = password_hash($password,password_default);  // store this hash

Then your login page.

$stmt = $conn->query("SELECT * from user where email= ? ");
$stmt->execute(array($email));

$row = $stmt->fetch();

if(password_verify($password,$row['passwordFromDB'])){

    session_start();
    $_SESSION['user']=$userdetails;
    //return what needs to be returned
}else{
    $error_message=array("message"=>("wrong"));
    echo json_encode($error_message);
}

NB : Make sure your database column have a length of 60+