Table of Contents
回复内容:
Home Backend Development PHP Tutorial 各位用php将密码存入数据库,都用什么方法进行加密的?

各位用php将密码存入数据库,都用什么方法进行加密的?

Jun 06, 2016 pm 08:45 PM
php encryption

都说md5不安全,貌似很多时候说是用sha1()进行加密更加安全,甚至还有用一种叫bcrypt的算法,各位phper平时都是怎么选择的呢?

回复内容:

都说md5不安全,貌似很多时候说是用sha1()进行加密更加安全,甚至还有用一种叫bcrypt的算法,各位phper平时都是怎么选择的呢?

题主你可以使用 md5 或者 sha1 进行初步处理,但为了更加安全,请你同时加上两个 salt,一个静态 salt,一个动态的 salt。以 md5 为例:
假设通过 POST 传来的密码为 $_POST['password'],在存入 DB 前先进行如下的操作:

<code>$password = hash('md5', $_POST['password'].$staticSalt.$dynamicSalt);
</code>
Copy after login

为了保证动态 salt 的唯一性,可以这样操作:

<code>$dynamicSalt = hash('md5', microtime());
</code>
Copy after login

对于动态的 salt 可以与生成的密码一起保存在 DB 中,而静态 salt 则可以直接放在类文件中(例如定义为一个静态属性即可)。

首先谢谢题主采纳了我的答案,但是我之前的回答并不是最佳答案,之所以有此加密的想法源于自己所读的源码可能比较老,所以并没使用上较新版本的加密方法,例如 bcrypt等。

此外,第二点,感谢评论中几位前辈的提点,已经明白设置静态 salt 的意义并不大,生成一个较长的动态 salt 已然可以解决问题。

LZ应该采用加盐HASH。
如何“腌制”密码呢?
=_,=
正确的格式应该是,用户password+动态的salt

动态的salt不能像2L所说的,使用microtime,因为时间在某些情况下不够随机,而且是可能被猜解的。
这里推荐一个我用的加盐HASH

$salt=base64_encode(mcrypt_create_iv(32,MCRYPT_DEV_RANDOM));
$password=sha1($register_password.$salt);
Copy after login

解释:
首先使用mcrypt,产生电脑随机生成的,专门用户加密的随机数函数。
第二步,把得到的随机数通过base64加密,使其变长并且不利于猜解。
第三步,把得出的盐拼接到密码的后面,再对其使用sha1进行哈希
再把password存入到用户的数据库。

PS:为何不用静态的salt?没有必要,使用一个动态随机足够长的盐足矣。
为何不用MD5?因为长度不够。
为何没有使用多次HASH?因为这样反而容易发生碰撞。
HASH好之后怎么使用“腌制”好的密码?
用户注册->提交密码->产生salt->腌制好的密码存入数据库->salt存入数据库。
用户登录->提交密码->调用salt接到提交密码的后面->进行HASH->调用之前注册腌制好的密码->对比HASH值是否和这个密码相同

最后推荐一篇文章,我是从中获益的,希望LZ也有所收获。
http://blog.jobbole.com/61872/

可以试试 phpass

对密码进行哈希相对安全的方法是使用bcrypt算法。开源的phpass库以一个易于使用的类来提供此功能。

这是我以前写的一篇关于密码加密的博文,欢迎参考。
http://www.wkii.org/save-user-password-use-bcrypt-or-pbkdf2.html

另外,请参考php5.5的内置函数
http://www.php.net/manual/zh/function.hash-pbkdf2.php

我写的pbkdf2与php5.5的函数输出结果一致。

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Roblox: Bubble Gum Simulator Infinity - How To Get And Use Royal Keys
3 weeks ago By 尊渡假赌尊渡假赌尊渡假赌
Mandragora: Whispers Of The Witch Tree - How To Unlock The Grappling Hook
3 weeks ago By 尊渡假赌尊渡假赌尊渡假赌
Nordhold: Fusion System, Explained
3 weeks ago By 尊渡假赌尊渡假赌尊渡假赌

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

Hot Topics

Java Tutorial
1668
14
PHP Tutorial
1273
29
C# Tutorial
1256
24
PHP: A Key Language for Web Development PHP: A Key Language for Web Development Apr 13, 2025 am 12:08 AM

PHP is a scripting language widely used on the server side, especially suitable for web development. 1.PHP can embed HTML, process HTTP requests and responses, and supports a variety of databases. 2.PHP is used to generate dynamic web content, process form data, access databases, etc., with strong community support and open source resources. 3. PHP is an interpreted language, and the execution process includes lexical analysis, grammatical analysis, compilation and execution. 4.PHP can be combined with MySQL for advanced applications such as user registration systems. 5. When debugging PHP, you can use functions such as error_reporting() and var_dump(). 6. Optimize PHP code to use caching mechanisms, optimize database queries and use built-in functions. 7

PHP and Python: Comparing Two Popular Programming Languages PHP and Python: Comparing Two Popular Programming Languages Apr 14, 2025 am 12:13 AM

PHP and Python each have their own advantages, and choose according to project requirements. 1.PHP is suitable for web development, especially for rapid development and maintenance of websites. 2. Python is suitable for data science, machine learning and artificial intelligence, with concise syntax and suitable for beginners.

PHP vs. Python: Understanding the Differences PHP vs. Python: Understanding the Differences Apr 11, 2025 am 12:15 AM

PHP and Python each have their own advantages, and the choice should be based on project requirements. 1.PHP is suitable for web development, with simple syntax and high execution efficiency. 2. Python is suitable for data science and machine learning, with concise syntax and rich libraries.

PHP in Action: Real-World Examples and Applications PHP in Action: Real-World Examples and Applications Apr 14, 2025 am 12:19 AM

PHP is widely used in e-commerce, content management systems and API development. 1) E-commerce: used for shopping cart function and payment processing. 2) Content management system: used for dynamic content generation and user management. 3) API development: used for RESTful API development and API security. Through performance optimization and best practices, the efficiency and maintainability of PHP applications are improved.

The Enduring Relevance of PHP: Is It Still Alive? The Enduring Relevance of PHP: Is It Still Alive? Apr 14, 2025 am 12:12 AM

PHP is still dynamic and still occupies an important position in the field of modern programming. 1) PHP's simplicity and powerful community support make it widely used in web development; 2) Its flexibility and stability make it outstanding in handling web forms, database operations and file processing; 3) PHP is constantly evolving and optimizing, suitable for beginners and experienced developers.

PHP vs. Other Languages: A Comparison PHP vs. Other Languages: A Comparison Apr 13, 2025 am 12:19 AM

PHP is suitable for web development, especially in rapid development and processing dynamic content, but is not good at data science and enterprise-level applications. Compared with Python, PHP has more advantages in web development, but is not as good as Python in the field of data science; compared with Java, PHP performs worse in enterprise-level applications, but is more flexible in web development; compared with JavaScript, PHP is more concise in back-end development, but is not as good as JavaScript in front-end development.

PHP and Python: Different Paradigms Explained PHP and Python: Different Paradigms Explained Apr 18, 2025 am 12:26 AM

PHP is mainly procedural programming, but also supports object-oriented programming (OOP); Python supports a variety of paradigms, including OOP, functional and procedural programming. PHP is suitable for web development, and Python is suitable for a variety of applications such as data analysis and machine learning.

PHP and Python: Code Examples and Comparison PHP and Python: Code Examples and Comparison Apr 15, 2025 am 12:07 AM

PHP and Python have their own advantages and disadvantages, and the choice depends on project needs and personal preferences. 1.PHP is suitable for rapid development and maintenance of large-scale web applications. 2. Python dominates the field of data science and machine learning.

See all articles