如何比较用户输入的散列密码？

Question

I want my login password to be secured. So I came up to use the PHP's crypt() function to hash the password before inserting it to database. But Im having trouble when comparing the user input password from the converted hash password. Here's my code:

<?php
$password = 'hello_password';

# A higher "cost" is more secure
$cost = 10;

# Create a random salt
$salt = strtr(base64_encode(mcrypt_create_iv(16, MCRYPT_DEV_URANDOM)), '+', '.');

# Blowfish algorithm. 
$salt = sprintf("$2a$%02d$", $cost) . $salt;
$salted_password = $password . $salt;  // apply salt to password

# hash the password
$hash_password = hash('sha256', $salted_password);

$userInput = 'hello_password';  // suppose this is the user input password 

if (hash('sha256',$userInput) == $password) {
    echo "Password Verified.";
}
else {
    echo "Incorrect Password";
}

?>

But it always displays Incorrect Password although my password is correct. I don't want to use "hash_equals" function as it is not supported with my current PHP version. Can someone help me with this ? Thanks

Answer 1

You're comparing a hashed user input to the actual user password. So of course this is never going to work.

You're basically asking if hash == 'hello_password'. A hash will never match that, that is the whole point of a hash. You also aren't using the salt with the user input.

You hash the actual password with a salt which is fine:

$salted_password = $password . $salt;  // apply salt to password

# hash the password
$hash_password = hash('sha256', $salted_password);

So you need to hash the user input with the salt, the same way:

$salted_input = $userInput . $salt;  // apply salt to user input

# hash the input
$hash_input = hash('sha256', $salted_input);

Then you can compare $hash_input with $hash_password.

You also aren't using a salt properly. The salt is supposed to be used in the storage of the password to prevent rainbow table attacks. Randomly generating a salt to apply to both the input and the password at the time of comparison is pointless.