正文
Yii2 用户登录
小程序：扫一扫查出行【扫一扫了解最新限行尾号】
复制小程序
在Yii2的basic版本中默认是从一个数组验证用户名和密码，如何改为从数据表中查询验证呢？且数据库的密码要为哈希加密密码验证？
下面我们就一步一步解析Yii2的登录过程。
一. 创建user表模型
表结构如下：
CREATE TABLE `user` (
`id` int(11) NOT NULL AUTO_INCREMENT,
`pid` int(11) NOT NULL DEFAULT '' COMMENT '父id',
`username` char(70) NOT NULL COMMENT '用户名',
`password` char(70) NOT NULL COMMENT '密码',
`type` tinyint(4) NOT NULL DEFAULT '' COMMENT '类型(1:总店,2:门店,3:管理员)',
`created_time` int(11) NOT NULL COMMENT '注册时间',
`updated_time` int(11) NOT NULL COMMENT '修改时间',
`status` tinyint(4) NOT NULL DEFAULT '' COMMENT '封禁状态，0禁止1正常',
`login_ip` char(20) NOT NULL COMMENT '登录ip',
`login_time` int(11) NOT NULL COMMENT '上一次登录时间',
`login_count` int(10) NOT NULL DEFAULT '' COMMENT '登陆次数',
`update_password` int(10) NOT NULL DEFAULT '' COMMENT '修改密码次数',
PRIMARY KEY (`id`),
KEY `pid` (`pid`),
KEY `username` (`username`),
KEY `type` (`type`),
KEY `status` (`status`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COMMENT='登录管理表';
使用Gii创建user模型
将Yii2 basic之前user模型代码导入现在user中（先备份之前basic中的user模型）
namespace app\models; use Yii; /**
* This is the model class for table "user".
*
* @property integer $id
* @property integer $pid
* @property string $username
* @property string $password
* @property integer $type
* @property integer $created_time
* @property integer $updated_time
* @property integer $status
* @property string $login_ip
* @property integer $login_time
* @property integer $login_count
* @property integer $update_password
*/
class User extends \yii\db\ActiveRecord implements \yii\web\IdentityInterface
{ public $authKey;
/*public $id;
public $username;
public $password;
public $authKey;
public $accessToken; private static $users = [
'100' => [
'id' => '100',
'username' => 'admin',
'password' => 'admin',
'authKey' => 'test100key',
'accessToken' => '100-token',
],
'101' => [
'id' => '101',
'username' => 'demo',
'password' => 'demo',
'authKey' => 'test101key',
'accessToken' => '101-token',
],
];
*/ /**
* @inheritdoc
*/
public static function tableName()
{
return 'user';
} /**
* @inheritdoc
*/
public function rules()
{
return [
[['pid', 'type', 'created_time', 'updated_time', 'status', 'login_time', 'login_count', 'update_password'], 'integer'],
[['username', 'password', 'created_time', 'updated_time', 'login_ip', 'login_time'], 'required'],
[['username', 'password'], 'string', 'max' => 70],
[['login_ip'], 'string', 'max' => 20]
];
} /**
* @inheritdoc
*/
public function attributeLabels()
{
return [
'id' => 'ID',
'pid' => 'Pid',
'username' => 'Username',
'password' => 'Password',
'type' => 'Type',
'created_time' => 'Created Time',
'updated_time' => 'Updated Time',
'status' => 'Status',
'login_ip' => 'Login Ip',
'login_time' => 'Login Time',
'login_count' => 'Login Count',
'update_password' => 'Update Password',
];
} /**
* @inheritdoc
*/
public static function findIdentity($id)
{
return static::findOne($id);
//return isset(self::$users[$id]) ? new static(self::$users[$id]) : null;
} /**
* @inheritdoc
*/
public static function findIdentityByAccessToken($token, $type = null)
{
return static::findOne(['access_token' => $token]);
/*foreach (self::$users as $user) {
if ($user['accessToken'] === $token) {
return new static($user);
}
} return null;*/
} /**
* Finds user by username
*
* @param string $username
* @return static|null
*/
public static function findByUsername($username)
{
$user = User::find()
->where(['username' => $username])
->asArray()
->one(); if($user){
return new static($user);
} return null;
/*foreach (self::$users as $user) {
if (strcasecmp($user['username'], $username) === 0) {
return new static($user);
}
} return null;*/
} /**
* @inheritdoc
*/
public function getId()
{
return $this->id;
} /**
* @inheritdoc
*/
public function getAuthKey()
{
return $this->authKey;
} /**
* @inheritdoc
*/
public function validateAuthKey($authKey)
{
return $this->authKey === $authKey;
} /**
* Validates password
*
* @param string $password password to validate
* @return boolean if password provided is valid for current user
*/
public function validatePassword($password)
{
return $this->password === $password;
}
}
之前的basic中User模型是继承了\yii\base\Object，为什么要继承这个类，那是因为
#在\yii\base\Object中，有构造方法
public function __construct($config = [])
{
if (!empty($config)) {
Yii::configure($this, $config);
}
$this->init();
}
#继续追踪Yii::configure($this, $config)代码如下
public static function configure($object, $properties)
{
foreach ($properties as $name => $value) {
$object->$name = $value;
} return $object;
}
#正是因为有这两个方法，所以在User.php中
public static function findByUsername($username)
{
foreach (self::$users as $user) {
if (strcasecmp($user['username'], $username) === 0) {
return new static($user);
}
} return null;
}
#将$user传递过来，通过static，返回一个User的实例。
当通过数据表查询时候没有必要再继承\yii\base\Object，因为不必为类似原来类变量赋值了。这个时候需要User模型继承\yii\db\ActiveRecord，因为要查询用。
findIdentity是根据传递的id返回对应的用户信息，getId返回用户id，getAuthKey和validateAuthKey是作用于登陆中的--记住我。这个authKey是唯一的，当再次登陆时，从cookie中获取authKey传递给validateAuthKey，验证通过，就登陆成功。
二. 模拟用户数据登录
插入一条用户模拟数据
INSERT INTO `user` (`username`, `password`) VALUES ('admin', '123')
控制器Controller
/**
* 登录
*/
public function actionLogin() {
if (!\Yii::$app->user->isGuest) {
return $this->goHome();
} $model = new LoginForm();
if ($model->load(Yii::$app->request->post()) && $model->login()) { $this->redirect(array('charisma/index'));
} else {
return $this->render('login', [
'model' => $model,
]);
}
}
veiws中的login.php
<div class="well col-md-5 center login-box">
<div class="alert alert-info">
请填写您的用户名和密码
</div> <?php $form = ActiveForm::begin([
'id' => 'login-form',
]); ?> <fieldset>
<div class="input-group input-group-lg">
<span class="input-group-addon"><i class="glyphicon glyphicon-user red"></i></span>
<?php echo Html::input('type','LoginForm[username]', $model->username, ['class'=>'form-control','placeholder'=>'Username']); ?>
</div>
<div class="clearfix"></div><br>
<div class="input-group input-group-lg">
<span class="input-group-addon"><i class="glyphicon glyphicon-lock red"></i></span>
<?php echo Html::input('password','LoginForm[password]', $model->password, ['class'=>'form-control','placeholder'=>'Password']); ?>
</div>
<div class="clearfix"></div> <div class="clearfix"></div>
<p class="center col-md-5">
<input type="submit" class="btn btn-primary" value="Login">
</p>
</fieldset>
<?php ActiveForm::end();?> <?php
if($model->errors){
echo '用户名或密码错误';
print_r($model->errors);
} ?> </div>
用户名admin， 密码123， 登录ok！
问题来了，我们使用的是明文保存的密码，这样很不安全，所以我们必须要把用户注册时的密码哈希加密后再保存到数据库。
注*
如若修改登录的表要修改main.php 配置：
'components' => [ 'user' => [
'identityClass' => 'app\models\Customer',
'enableAutoLogin' => true,
],
将identityClass中common\models\User 改为app\models\Customer, 此时Customer表便可为定了表
三. Yii的密码加密
YII2对密码加密生成的结果是不同的，即用相同的初始密码在不同时间得到的加密结果不同，所以我们不能用常用的方法去验证密码是否正确（将密码加密后与数据库中的密码相比较）。YII2有自己的加密以及密码验证流程。
加密
$hash = Yii::$app->getSecurity()->generatePasswordHash('123456');
验证
Yii::$app->getSecurity()->validatePassword('123456', $hash) ; #,返回true或false
我们先通过Yii的加密机制加密 “123” 获取哈希密码为： $2y$13$eXQl9YCo5XcKqqy9ymd2t.SuOvpXYERidceXoT/bPt4iwmOW3GiBy
修改模拟数据admin的密码：
UPDATE `user` SET `password`='$2y$13$eXQl9YCo5XcKqqy9ymd2t.SuOvpXYERidceXoT/bPt4iwmOW3GiBy' WHERE (`username`='admin')
四.密码验证过程
在控制器中我们通过 实例化LoginForm，
Yii::$app->request->post()来获取post提交的值，通过$model->load()加载post数据
然后$model->login() 就是验证登录
$model = new LoginForm();
if ($model->load(Yii::$app->request->post()) && $model->login()) {
$this->redirect(array('charisma/index'));
}
我们跳转到app\models\LoginForm的login方法
public function login()
{ if ($this->validate()) { return Yii::$app->user->login($this->getUser(), $this->rememberMe ? 3600*24*30 : 0);
} else {
return false;
}
}
login方法又是通过一个validate验证方法 继承vendor/yiisoft/yii2/base/Model.php
该验证方法描述是这样的：Performs the data validation. This method executes the validation rules applicable to the current [[scenario]]. The following criteria are used to determine whether a rule is currently applicable: - the rule must be associated with the attributes relevant to the current scenario; - the rules must be effective for the current scenario. This method will call [[beforeValidate()]] and [[afterValidate()]] before and after the actual validation, respectively. If [[beforeValidate()]] returns false, the validation will be cancelled and [[afterValidate()]] will not be called. Errors found during the validation can be retrieved via [[getErrors()]], [[getFirstErrors()]] and [[getFirstError()]].
我们打开model类的validate()
public function validate($attributeNames = null, $clearErrors = true)
{
if ($clearErrors) {
$this->clearErrors();
} if (!$this->beforeValidate()) {
return false;
} $scenarios = $this->scenarios();
$scenario = $this->getScenario();
if (!isset($scenarios[$scenario])) {
throw new InvalidParamException("Unknown scenario: $scenario");
} if ($attributeNames === null) {
$attributeNames = $this->activeAttributes();
} foreach ($this->getActiveValidators() as $validator) {
$validator->validateAttributes($this, $attributeNames);
}
$this->afterValidate(); return !$this->hasErrors();
}
也就是说获取到场景且没有错误的话，将场景yii\validators\RequiredValidator Object的每一个属性实例化为对应Form规则（rules）实例
foreach ($this->getActiveValidators() as $validator) {
$validator->validateAttributes($this, $attributeNames);
}
现在找到LoginForm的验证规则
/**
* @return array the validation rules.
*/
public function rules()
{
return [
// username and password are both required
[['username', 'password'], 'required'],
// rememberMe must be a boolean value
['rememberMe', 'boolean'],
// password is validated by validatePassword()
['password', 'validatePassword'],
];
}
其中username,password 必填， rememberMe为波尔类型， password通过ValidatePassword方法来验证
查看validatePassword方法
/**
* Validates the password.
* This method serves as the inline validation for password.
*
* @param string $attribute the attribute currently being validated
* @param array $params the additional name-value pairs given in the rule
*/
public function validatePassword($attribute, $params)
{
if (!$this->hasErrors()) {
$user = $this->getUser(); if (!$user || !$user->validatePassword($this->password)) {
$this->addError($attribute, 'Incorrect username or password.');
}
}
}
首先$this->getUser()会判断在user表中是否有username=“admin”，如果存在就返回一个user的实例
public static function findByUsername($username) {
$user = User::find()
->where(['username' => $username])
->asArray()
->one();
if ($user) {
return new static($user);
} return null; }
通过$user->validatePassword($this->password) 判断验证密码，这个是最关键的一步
因为之前通过$this->getUser 已经实例化了user表，所以validatePassword在User模型的原始代码是这样的
/**
* Validates password
*
* @param string $password password to validate
* @return boolean if password provided is valid for current user
*/
public function validatePassword($password) { return $this->password === $password;
}
获取用户输入的密码， 再和数据库中的密码做对比，如果密码相同就通过验证。
现在我们已经把密码123改为哈希密码：$2y$13$eXQl9YCo5XcKqqy9ymd2t.SuOvpXYERidceXoT/bPt4iwmOW3GiBy
所以要通过Yii2 自带的验证 Yii::$app->getSecurity()->validatePassword('123456', $hash) ; 进行验证
所以validatePassword方法的代码应该修改如下：
/**
* Validates password
*
* @param string $password password to validate
* @return boolean if password provided is valid for current user
*/
public function validatePassword($password) { return Yii::$app->getSecurity()->validatePassword($password, $this->password);
}
完整的LoginForm模型和User模型代码如下：
<?php namespace app\models; use Yii;
use yii\base\Model; /**
* LoginForm is the model behind the login form.
*/
class LoginForm extends Model
{
public $username;
public $password;
public $rememberMe = true; private $_user = false; /**
* @return array the validation rules.
*/
public function rules()
{
return [
// username and password are both required
[['username', 'password'], 'required'],
// rememberMe must be a boolean value
['rememberMe', 'boolean'],
// password is validated by validatePassword()
['password', 'validatePassword'],
];
} /**
* Validates the password.
* This method serves as the inline validation for password.
*
* @param string $attribute the attribute currently being validated
* @param array $params the additional name-value pairs given in the rule
*/
public function validatePassword($attribute, $params)
{
if (!$this->hasErrors()) {
$user = $this->getUser(); if (!$user || !$user->validatePassword($this->password)) {
$this->addError($attribute, 'Incorrect username or password.');
}
}
} /**
* Logs in a user using the provided username and password.
* @return boolean whether the user is logged in successfully
*/
public function login()
{
if ($this->validate()) {
return Yii::$app->user->login($this->getUser(), $this->rememberMe ? 3600*24*30 : 0);
} else {
return false;
}
} /**
* Finds user by [[username]]
*
* @return User|null
*/
public function getUser()
{
if ($this->_user === false) {
$this->_user = User::findByUsername($this->username);
} return $this->_user;
}
}
<?phpnamespace app\models;use Yii;/**
* This is the model class for table "user".
*
* @property integer $id
* @property integer $pid
* @property string $username
* @property string $password
* @property integer $type
* @property integer $created_time
* @property integer $updated_time
* @property integer $status
* @property string $login_ip
* @property integer $login_time
* @property integer $login_count
* @property integer $update_password
*/
class User extends \yii\db\ActiveRecord implements \yii\web\IdentityInterface
{
public $authKey;
/**
* @inheritdoc
*/
public static function tableName()
{
return 'user';
} /**
* @inheritdoc
*/
public function rules()
{
return [
[['pid', 'type', 'created_time', 'updated_time', 'status', 'login_time', 'login_count', 'update_password'], 'integer'],
[['username', 'password', 'created_time', 'updated_time', 'login_ip', 'login_time'], 'required'],
[['username', 'password'], 'string', 'max' => 70],
[['login_ip'], 'string', 'max' => 20]
];
} /**
* @inheritdoc
*/
public function attributeLabels()
{
return [
'id' => 'ID',
'pid' => 'Pid',
'username' => 'Username',
'password' => 'Password',
'type' => 'Type',
'created_time' => 'Created Time',
'updated_time' => 'Updated Time',
'status' => 'Status',
'login_ip' => 'Login Ip',
'login_time' => 'Login Time',
'login_count' => 'Login Count',
'update_password' => 'Update Password',
];
} /**
* @inheritdoc
*/
public static function findIdentity($id) {
return static::findOne($id);
} /**
* @inheritdoc
*/
public static function findIdentityByAccessToken($token, $type = null) {
return null;
} /**
* Finds user by username
*
* @param string $username
* @return static|null
*/
public static function findByUsername($username) {
$user = User::find()
->where(['username' => $username])
->asArray()
->one();
if ($user) {
return new static($user);
} return null;
} /**
* @inheritdoc
*/
public function getId() {
return $this->id;
} /**
* @inheritdoc
*/
public function getAuthKey() {
return $this->authKey;
} /**
* @inheritdoc
*/
public function validateAuthKey($authKey) {
return $this->authKey === $authKey;
} /**
* Validates password
*
* @param string $password password to validate
* @return boolean if password provided is valid for current user
*/
public function validatePassword($password) { return Yii::$app->getSecurity()->validatePassword($password, $this->password); #,返回true或false
} #-------------------------------------辅助验证----------------------------------------------------------- public function createhashpasswd(){
echo Yii::$app->getSecurity()->generatePasswordHash('123');
}}
ok，这样就实现了哈希加密的用户登录了。
附 Yii的 密码验证
crypt() 函数
crypt() 函数返回使用 DES、Blowfish 或 MD5 算法加密的字符串。
在不同的操作系统上，该函数的行为不同，某些操作系统支持一种以上的算法类型。在安装时，PHP 会检查什么算法可用以及使用什么算法。
具体的算法依赖于 salt 参数的格式和长度。通过增加由使用特定加密方法的特定字符串所生成的字符串数量，salt 可以使加密更安全。
这里有一些和 crypt() 函数一起使用的常量。这些常量值是在安装时由 PHP 设置的。
常量：
| [CRYPT_SALT_LENGTH] | 默认的加密长度。使用标准的 DES 加密，长度为 2 |
| [CRYPT_STD_DES] | 基于标准 DES 算法的散列使用 "./0-9A-Za-z" 字符中的两个字符作为盐值。在盐值中使用非法的字符将导致 crypt() 失败。 |
| [CRYPT_EXT_DES] | 扩展的基于 DES 算法的散列。其盐值为 9 个字符的字符串，由 1 个下划线后面跟着 4 字节循环次数和 4 字节盐值组成。它们被编码成可打印字符，每个字符 6 位，有效位最少的优先。0 到 63 被编码为 "./0-9A-Za-z"。在盐值中使用非法的字符将导致 crypt() 失败。 |
| [CRYPT_MD5] | MD5 散列使用一个以 $1$ 开始的 12 字符的字符串盐值。 |
| [CRYPT_BLOWFISH] | Blowfish 算法使用如下盐值：“$2a$”，一个两位 cost 参数，“$” 以及 64 位由 “./0-9A-Za-z” 中的字符组合而成的字符串。在盐值中使用此范围之外的字符将导致 crypt() 返回一个空字符串。两位 cost 参数是循环次数以 2 为底的对数，它的范围是 04-31，超出这个范围将导致 crypt() 失败。 |
| CRYPT_SHA256 | SHA-256 算法使用一个以 $5$ 开头的 16 字符字符串盐值进行散列。如果盐值字符串以 “rounds=<N>$” 开头，N 的数字值将被用来指定散列循环的执行次数，这点很像 Blowfish 算法的 cost 参数。默认的循环次数是 5000，最小是 1000，最大是 999,999,999。超出这个范围的 N 将会被转换为最接近的值。 |
| CRYPT_SHA512 | SHA-512 算法使用一个以 $6$ 开头的 16 字符字符串盐值进行散列。如果盐值字符串以 “rounds=<N>$” 开头，N 的数字值将被用来指定散列循环的执行次数，这点很像 Blowfish 算法的 cost 参数。默认的循环次数是 5000，最小是 1000，最大是 999,999,999。超出这个范围的 N 将会被转换为最接近的值。 |
在该函数支持多种算法的系统上，如果支持上述常量则设置为 "1"，否则设置为 "0"。
注释：没有相应的解密函数。crypt() 函数使用一种单向算法。
测试不同的算法
// 两字符 salt
if (CRYPT_STD_DES == 1)
{
echo "Standard DES: ".crypt('something','st')."\n<br>";
}
else
{
echo "Standard DES not supported.\n<br>";
}// 4 字符 salt
if (CRYPT_EXT_DES == 1)
{
echo "Extended DES: ".crypt('something','_S4..some')."\n<br>";
}
else
{
echo "Extended DES not supported.\n<br>";
}//以 $1$ 开始的 12 字符
if (CRYPT_MD5 == 1)
{
echo "MD5: ".crypt('something','$1$somethin$')."\n<br>";
}
else
{
echo "MD5 not supported.\n<br>";
}// 以 $2a$ 开始的 Salt。双数字的 cost 参数：09. 22 字符
if (CRYPT_BLOWFISH == 1)
{
echo "Blowfish: ".crypt('something','$2a$09$anexamplestringforsalt$')."\n<br>";
}
else
{
echo "Blowfish DES not supported.\n<br>";
}// 以 $5$ 开始的 16 字符 salt。周长的默认数是 5000。
if (CRYPT_SHA256 == 1)
{
echo "SHA-256: ".crypt('something','$5$rounds=5000$anexamplestringforsalt$')."\n<br>"; }
else
{
echo "SHA-256 not supported.\n<br>";
}// 以 $5$ 开始的 16 字符 salt。周长的默认数是 5000。
if (CRYPT_SHA512 == 1)
{
echo "SHA-512: ".crypt('something','$6$rounds=5000$anexamplestringforsalt$');
}
else
{
echo "SHA-512 not supported.";
}
代码的输出
Standard DES: stqAdD7zlbByI
Extended DES: _S4..someQXidlBpTUu6
MD5: $1$somethin$4NZKrUlY6r7K7.rdEOZ0w.
Blowfish: $2a$09$anexamplestringforsaleLouKejcjRlExmf1671qw3Khl49R3dfu
SHA-256: $5$rounds=5000$anexamplestringf$KIrctqsxo2wrPg5Ag/hs4jTi4PmoNKQUGWFXlVy9vu9
SHA-512: $6$rounds=5000$anexamplestringf$Oo0skOAdUFXkQxJpwzO05wgRHG0dhuaPBaOU/
oNbGpCEKlf/7oVM5wn6AN0w2vwUgA0O24oLzGQpp1XKI6LLQ0.
yii 密码匹配实现过程
// 简单的crypt验证
$sa='$2y$05$'.substr(base64_encode(md5(rand(100000, 999999999))), 0, 22); // salt
$sa2= generateSalt(5); // salt2
$hash = crypt('123456', $sa);
print_r($hash);
echo '<p>';
$validpwd= crypt('123456', $hash);
print_r($validpwd);
echo '<p>';
输出结果：
$2y$05$Y2NjNzBjNDA3OThmM2FkNubFNy9pV695W//LpeFEN6eBizIQBtMxO
$2y$05$Y2NjNzBjNDA3OThmM2FkNubFNy9pV695W//LpeFEN6eBizIQBtMxOtrue
yii 密码匹配代码精简版
<?php
$hash = generatePasswordHash('123456');
$validpwd = validatePassword('123456', '$2y$13$RtC1BSDoTVbWtckxKJO5Ge9ikm8LFAEsYX97JeJ72mHHbFgzRdw7.'); #, 参数2 =$hash
if($validpwd){
echo 'true';
}else{
echo 'false';
}function generatePasswordHash($password, $cost = 13) {
$salt = generateSalt($cost); $hash = crypt($password, $salt);
// strlen() is safe since crypt() returns only ascii
if (!is_string($hash) || strlen($hash) !== 60) {
throw new Exception('Unknown error occurred while generating hash.');
}
return $hash;
}function generateSalt($cost = 13) {
$cost = (int) $cost;
if ($cost < 4 || $cost > 31) {
throw new InvalidParamException('Cost must be between 4 and 31.');
} // Get a 20-byte random string
$rand = generateRandomKey(20); // Form the prefix that specifies Blowfish (bcrypt) algorithm and cost parameter.
$salt = sprintf("$2y$%02d$", $cost);
// Append the random salt data in the required base64 format.
$salt .= str_replace('+', '.', substr(base64_encode($rand), 0, 22)); return $salt;
}function generateRandomKey($length = 32) {
/*
* Strategy
*
* The most common platform is Linux, on which /dev/urandom is the best choice. Many other OSs
* implement a device called /dev/urandom for Linux compat and it is good too. So if there is
* a /dev/urandom then it is our first choice regardless of OS.
*
* Nearly all other modern Unix-like systems (the BSDs, Unixes and OS X) have a /dev/random
* that is a good choice. If we didn't get bytes from /dev/urandom then we try this next but
* only if the system is not Linux. Do not try to read /dev/random on Linux.
*
* Finally, OpenSSL can supply CSPR bytes. It is our last resort. On Windows this reads from
* CryptGenRandom, which is the right thing to do. On other systems that don't have a Unix-like
* /dev/urandom, it will deliver bytes from its own CSPRNG that is seeded from kernel sources
* of randomness. Even though it is fast, we don't generally prefer OpenSSL over /dev/urandom
* because an RNG in user space memory is undesirable.
*
* For background, see http://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/
*/
$bytes = ''; if (!extension_loaded('openssl')) {
throw new InvalidConfigException('The OpenSSL PHP extension is not installed.');
}// die($cryptoStrong); $bytes .= openssl_random_pseudo_bytes($length,$cryptoStrong); #create rand # &$cryptoStrong=1//echo $length;
if(byteLength($bytes) > $length){
echo 'aaa';
}//exit( byteSubstr($bytes, 0, $length));
if (byteLength($bytes) < $length || !$cryptoStrong) {
echo 'sdf';
throw new Exception('Unable to generate random bytes.');
} return byteSubstr($bytes, 0, $length);
}function byteLength($string) {
return mb_strlen($string, '8bit');
}function byteSubstr($string, $start, $length = null) {
return mb_substr($string, $start, $length === null ? mb_strlen($string, '8bit') : $length, '8bit');
}function validatePassword($password, $hash) {
if (!is_string($password) || $password === '') {
throw new InvalidParamException('Password must be a string and cannot be empty.');
} if (!preg_match('/^\$2[axy]\$(\d\d)\$[\.\/0-9A-Za-z]{22}/', $hash, $matches) || $matches[1] < 4 || $matches[1] > 30) {
throw new InvalidParamException('Hash is invalid.');
} $test = crypt($password, $hash);
$n = strlen($test);
if ($n !== 60) {
return false;
}
return compareString($test, $hash);
}function compareString($expected, $actual) { $expected .= "\0";
$actual .= "\0";
$expectedLength = byteLength($expected);
$actualLength = byteLength($actual);
$diff = $expectedLength - $actualLength;
for ($i = 0; $i < $actualLength; $i++) {
$diff |= (ord($actual[$i]) ^ ord($expected[$i % $expectedLength]));
}
return $diff === 0;
}
