Home > Article > Backend Development > Function introduction of PHP function crypt()_PHP tutorial
Function introduction of PHP function crypt()_PHP tutorial
- WBOYOriginal
- 2016-07-15 13:30:471240browse
We know that there is a function to implement data encryption in PHP. What we will introduce to you today is one of the functions that can implement data encryption function - PHP function crypt(). As an example of the PHP function crypt(), consider a situation where you wish to create a PHP script that restricts access to a directory to only users who can provide the correct username and password.
I will store the data in a table in MySQL, my favorite database. Let's start our example by creating the table called members:
<ol class="dp-xml"> <li class="alt"><span><span>mysql</span><span class="tag">></span><span>CREATE TABLE members ( </span></span></li> <li> <span>-</span><span class="tag">></span><span>username CHAR(14) NOT NULL, </span> </li> <li class="alt"> <span>-</span><span class="tag">></span><span>password CHAR(32) NOT NULL, </span> </li> <li> <span>-</span><span class="tag">></span><span>PRIMARY KEY(username) </span> </li> <li class="alt"> <span>-</span><span class="tag">></span><span>); </span> </li> </ol>
Then, we assume that the following data is already stored in the table:
Username Password
clark keloD1C377lKE
bruce ba1T7vnz9AWgk
peter paLUvRWsRLZ4U
The plain codes corresponding to these encrypted passwords in the PHP function crypt() are kent, banner and parker respectively. Pay attention to the first two letters of each password. This is because I used the following code to create a interference string based on the first two letters of the password:
<ol class="dp-xml"> <li class="alt"><span><span>$enteredPassword. </span></span></li> <li> <span>$</span><span class="attribute">salt</span><span> = </span><span class="attribute-value">substr</span><span>($enteredPassword, 0, 2); </span> </li> <li class="alt"> <span>$</span><span class="attribute">userPswd</span><span> = </span><span class="attribute-value">crypt</span><span>($enteredPassword, $salt); </span> </li> <li><span>// $userPswd然后就和用户名一起存储在MySQL 中 </span></li> </ol>
I will be using Apache's password-response authentication configuration to prompt the user for a username and password. A little known fact about PHP is that it can recognize the username and password entered by the Apache password-response system as $PHP_AUTH_USER and $PHP_AUTH_PW, I will use these two variables in the authentication script. Take some time to read the following script carefully and pay more attention to the explanations to better understand the following code:
Application of PHP function crypt() and Apache's password-response verification system
<ol class="dp-xml"><li class="alt"><span><span class="tag"><</span><span> ?php </span></span></li><li><span>$</span><span class="attribute">host</span><span> = </span><span class="attribute-value">"localhost"</span><span>; </span></li><li class="alt"><span>$</span><span class="attribute">user</span><span> = </span><span class="attribute-value">"zorro"</span><span>; </span></li><li><span>$</span><span class="attribute">pswd</span><span> = </span><span class="attribute-value">"hell odolly"</span><span>; </span></li><li class="alt"><span>$</span><span class="attribute">db</span><span> = </span><span class="attribute-value">"users"</span><span>; </span></li><li><span>// Set authorization to False </span></li><li class="alt"><span>$</span><span class="attribute">authorization</span><span> = </span><span class="attribute-value">0</span><span>; </span></li><li><span>// Verify that user has entered<br /> username and password </span></li><li class="alt"><span>if (isset($PHP_AUTH_USER) && <br />isset($PHP_AUTH_PW)) : </span></li><li><span>mysql_pconnect($host, $user, <br />$pswd) or die("Can't connect to MySQL </span></li><li class="alt"><span>server!"); </span></li><li><span>mysql_select_db($db) or die<br />("Can't select database!"); </span></li><li class="alt"><span>// Perform the encryption </span></li><li><span>$</span><span class="attribute">salt</span><span> = </span><span class="attribute-value">substr</span><span>($PHP_AUTH_PW, 0, 2); </span></li><li class="alt"><span>$</span><span class="attribute">encrypted_pswd</span><span> = crypt($PHP_AUTH_PW, $salt); </span></li><li><span>// Build the query </span></li><li class="alt"><span>$</span><span class="attribute">query</span><span> = "SELECT username FROM members WHERE </span></li><li><span class="attribute">username</span><span> = '$PHP_AUTH_USER' AND </span></li><li class="alt"><span class="attribute">password</span><span> = '$encrypted_pswd'"; </span></li><li><span>// Execute the query </span></li><li class="alt"><span>if (mysql_numrows(mysql_query($query)) == 1) : </span></li><li><span>$</span><span class="attribute">authorization</span><span> = </span><span class="attribute-value">1</span><span>; </span></li><li class="alt"><span>endif; </span></li><li><span>endif; </span></li><li class="alt"><span>// confirm authorization </span></li><li><span>if (! $authorization) : </span></li><li class="alt"><span>header('WWW-Authenticate: <br />Basic </span><span class="attribute">realm</span><span>=</span><span class="attribute-value">"Private"</span><span>'); </span></li><li><span>header('HTTP/1.0 401 Unauthorized'); </span></li><li class="alt"><span>print "You are unauthorized <br />to enter this area."; </span></li><li><span>exit; </span></li><li class="alt"><span>else : </span></li><li><span>print "This is the secret data!"; </span></li><li class="alt"><span>endif; </span></li><li><span class="tag">?></span><span> </span></span></li></ol>
The above is a simple authentication system to verify user access rights. When using the PHP function crypt() to protect important confidential information, remember that the PHP function crypt() used by default is not the most secure and can only be used in systems with lower security requirements. If necessary Higher security performance requires the algorithm I introduce later in this article.