我有一个用 PHP 编写的简单注册脚本,我只是想知道我所采用的方法是否足够安全来存储用户密码。我正在生成一个 32 位的随机盐,并将其附加到一个 sha1 哈希密码后面。
//create new validator object
$validator = new data_validation();
//validate user input
$firstName = $validator->validate_fname($firstName); //is the first name a string?
$lastName = $validator->validate_lname($lastName); // is the last name a string?
$username = $validator->validate_username($username); // is the username a string?
$email = $validator->validate_email($email); //is the email in valid format?
//make sure there isn't duplicate emails
$valQuery = $link->query("SELECT email FROM users WHERE email = '" .$email. "'");
if ($valQuery->num_rows == 1) {
echo "An email is already registered with that address";
return false;
}
// generate a random salt for converting passwords into sha1
$salt = $link->real_escape_string(bin2hex(mcrypt_create_iv(32, MCRYPT_DEV_URANDOM)));
$saltedPW = $password . $salt;
$hashedPW = sha1($saltedPW);
mysqli_connect($db_host, $db_user, $db_pass) OR DIE (mysqli_error());
// select the db
mysqli_select_db ($link, $db_name) OR DIE ("Unable to select db".mysqli_error($db_name));
// our sql query
$sql = "INSERT INTO users (first_name, last_name, username, email, password, salt) VALUES ('$firstName', '$lastName', '$username', '$email', '$hashedPW', '$salt');";
//save the updated information to the database
$result = mysqli_query($link, $sql) or die("Error in Query: " . mysqli_error($link));
if (!mysqli_error($link))
{
$row = mysqli_fetch_assoc($result);
$_SESSION['user_id'] = $row['user_id'];
$_SESSION['loggedin'] = TRUE;
header("Location: ../home");
}
此外,我正在使用过程化和面向对象的php结合。大部分代码都是过程化的,但是有一些面向对象的类,比如你在上面脚本中看到的验证类。同时使用这两种风格会造成性能问题吗?