Confirmation email with password_hash

Question

Confirmation email with password_hash

Navigation

#1 by (-1 votes)

-1

By registering on the site, the user receives an email to activate the registration, until then everything is right. The problem is with checking the password_hash, I know you have password_verify, but in this case it seems that you can not use it. The $ key variable takes the encrypted user id using the password_hash.

<!DOCTYPE html>
<html>
    <head>
        <meta charset="UTF-8">
        <title>Email de confirmação</title>
    </head>
    <body>
        <?php
        $key = filter_input(INPUT_GET, 'key', FILTER_SANITIZE_SPECIAL_CHARS);
        $verify = $conexao->prepare("select * from user where password_hash(id) = '$key'");
        $verify->execute();
        if($verify){
            $id = $verify->fetch(PDO::FETCH_OBJ);
            $confirm = $conexao->prepare("update user set confirm = 1 where id = :id");
            $confirm->bindValue(':id', $id->id, PDO::PARAM_INT);
            $confirm->execute();
            echo 'Cadastro ativado com sucesso!';
        }else{
            echo 'Erro ao ativar cadastro';
        }
        ?>
    </body>
</html>

As shown above, I tried to check the user id in the database, like this:

$verify = $conexao->prepare("select * from user where password_hash(id) = '$key'");

And so too:

$verify = $conexao->prepare("select * from user where password_hash(id, PASSWORD_DEFAULT) = '$key'");

But as expected it gave error: 'Syntax error or access violation: 1305 FUNCTION password_hash does not exist', I saw that it can do this with MD5. Is it possible to do something like this with password_hash?

php mysql criptografia

asked by anonymous 17.07.2018 / 05:24

1 answer

UPDATE SQL in C # (Windows Forms) Help with pointer error in Java

score -1 · Answer 1

The error is in your Query. using MD5 (id) works because mysql has this function implemented. You can do the following: encrypt the value of the user id and then compare the hash generated with the saved in the bank, being as follows:

    $key = password_hash(filter_input(INPUT_GET, 'key', FILTER_SANITIZE_SPECIAL_CHARS));
    $verify = $conexao->prepare("select * from user where id = '$key'");
    $verify->execute();