用于登录的php md5不会让我登录，并且一直说密码不正确

Question

The md5 is posting to the database from the signup page so I know that's working, but everything I try here won't let me sign in and just keeps telling me I have the wrong password.

 <?php 
// Parse the log in form if the user has filled it out and pressed "Log In"
if (isset($_POST["user_name"]) ) {

        $user = mysql_real_escape_string($_POST["user_name"]);      
        $pass_word = mysql_real_escape_string(md5($_POST["pass_word"]));
   $pass_word=md5($pass_word);

    // Connect to the MySQL database  
    include "../connect_to_mysql.php"; 
    $sql = mysql_query("SELECT m_id FROM member WHERE user_name='$user' AND pass_word='$pass_word' LIMIT 1"); // query the person
     // ------- MAKE SURE PERSON EXISTS IN DATABASE ---------
    $existCount = mysql_num_rows($sql); // count the row nums
    if ($existCount == 1) { // evaluate the count
         while($row = mysql_fetch_array($sql)){ 
             $id = $row["m_id"];
     }
         $_SESSION["m_id"] = $id;
         $_SESSION["user"] = $user;
         $_SESSION["pass_word"] = $pass_word;

         header("location: ../../index.php");
         exit();
    } else {
        echo 'That information is incorrect, try again <a     href="member_login.php">Click Here</a>'; 
        exit();
    }
}
?>

Answer 1

You're running MD5 twice on your password.

$pass_word = mysql_real_escape_string(md5($_POST["pass_word"]));
$pass_word = md5($pass_word);

Also, don't use MD5, it is completely unsafe, look into using bcrypt, it is secure, and very easy to implement in PHP. Replacing MD5 with this line of code will make your password hashes safe. Preferably add some salt, the salt being some random string. It will make breaking your passwords nigh impossible.

$hash = password_hash($password . $salt, PASSWORD_BCRYPT);