blocks|key|2448671|text|是的，这就是你看到的哈希。如果您正在使用md5()，请确保至少使用一种盐。为每个用户提供一个可变的盐分是理想的。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|2448672|我还建议您研究一下bcrypt。它比其他哈希函数慢得多，而且更安全。|2448673|另一个选项是PHP的地窖函数。|2448674|这个问题对一些散列/加密方法有几个答案。您也应该检查一下：如何使用bcrypt在PHP中哈希密码？|2448675|但是，如果您通过HTTP发送用户密码，所有这些都将是徒劳的。因此，请确保您也有HTTPS和SSL设置。并强制执行强密码！(免责声明-一些人反对强制使用强密码，因为它激怒了用户。)你必须决定)|2448676|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/Bcrypt|1|http://php.net/manual/en/function.crypt.php|2|https://stackoverflow.com/questions/4795385/^0|K|5|0|9|6|0|0|A|2|1|0|T|K|2|0|0^^$0|@$1|2|3|4|5|6|7|Z|8|@$9|10|A|11|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|12|8|@]|D|@$9|13|A|14|1|15]]|E|$]]|$1|H|3|I|5|6|7|16|8|@]|D|@$9|17|A|18|1|19]]|E|$]]|$1|J|3|K|5|6|7|1A|8|@]|D|@$9|1B|A|1C|1|1D]]|E|$]]|$1|L|3|M|5|6|7|1E|8|@]|D|@]|E|$]]|$1|N|3|-4|5|6|7|1F|8|@]|D|@]|E|$]]]|O|$P|$5|Q|R|S|E|$T|U]]|V|$5|Q|R|S|E|$T|W]]|X|$5|Q|R|S|E|$T|Y]]]]

Yes, that's the hash you're seeing. If you're using <code>md5()</code> make sure to at least use a salt. A variable salt for each user would be ideal. 

I would also suggest you look into <a href="http://en.wikipedia.org/wiki/Bcrypt" rel="nofollow noreferrer">bcrypt</a>. It's much slower than other hash functions and is more secure as well. 

Another option is PHP's <a href="http://php.net/manual/en/function.crypt.php" rel="nofollow noreferrer">crypt</a> function. 

This SO question has a few answers for and against some hashing/encryption methods. You should check that out as well : <a href="https://stackoverflow.com/questions/4795385/">How do you use bcrypt for hashing passwords in PHP?</a>

All this will be for naught if you send user passwords over HTTP though. So make sure you have HTTPS and SSL setup as well. And enforce strong passwords! (disclaimer - some people argue against forcing strong passwords because it pisses off users. You will have to decide)

blocks|key|2448600|text|MD5不是加密，而是散列。哈希函数的设计不是要反转的，但是它的输出被认为是相对唯一的，尽管它的长度是固定的，所以如果您使用像SHA-1或SHA-2这样的加密安全的密码(MD5不再是密码安全的)，那么这是一种安全存储密码的好方法。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2448601|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

MD5 is not encryption, it's hashing. A hashing function is not designed to be reversed, but its output is assumed to be relatively unique despite its fixed length so it's a good way to securely store passwords, if you use a cryptographically secure one like SHA-1 or SHA-2 (MD5 is no longer cryptographically secure).

blocks|key|2448643|text|MD5是散列函数。它的工作方式是使用一个很难逆转的数学运算。这是存储密码的好方法。对于登录检查，您只需使用使用登录表单提供的密码，也可以应用MD5函数，并比较结果。不过，还有一个警告:+MD5不再被认为是安全的了。使用SHA-1或其他。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2448644|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/Hash_function^0|4|4|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

MD5 is a <a href="http://en.wikipedia.org/wiki/Hash_function" rel="nofollow">Hash-Function</a>. It works by using a mathematical operation that cannot be easily reversed. It is a good way to store passwords. For the login-check, you simply take to password provided using the login form, apply the MD5 function to this too, and compare the results.
A word of warning though: MD5 is not considered secure anymore. Use SHA-1 or others instead.

blocks|key|2807659|text|在写这篇文章时，我认为还没有明确说明的是，使用散列函数的问题是第三方生成大量的预散列随机数字和字母索引，或者常用的密码和名称。如果您的数据库每次都要被破坏，那么您的散列肯定会与这些查找表进行比较，并且可能会猜测它们是否在其中。他们所需要的只是一个幸运的管理员密码匹配。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2807660|这些预先计算的哈希查找表的术语通常被称为“彩虹表”。|2807661|这可以通过使用随机字符序列来有效地避免哈希，因此每个密码都添加了一些内容，减少了已经在查找表中预先计算和索引的可能性。如果需要，可以为每个用户生成此"salt“。|2807662|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

What I believe that has not been explicitly stated at the time of writing this, is that the use of a hashing function has the issue of third parties generating massive indexes of pre-hashed random numbers and letters, or commonly used passwords and names. If your database were every to be breached, most certainly your hashes would be compared to these lookup tables and possibly guessed if they were in there. All they would need is a single lucky match of the administrator's password.

The term for these pre-computed hash lookup tables is generally dubbed "Rainbow tables"

This can be avoided effectively by salting your hashes with a random sequence of characters, therefor each password has something added to it reducing the possibility it has already been pre-computed and indexed in a lookup table. This "salt" can be generated for every user if need be.

blocks|key|2448722|text|MD5哈希不是破解密码的最佳方式，它在几年前就变成了“破坏”(反向工程)。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2448723|而仅仅对密码进行散列并不是一个理想的安全级别。使用盐类、散列和迭代是。下面是我通常创建和存储用户密码的方式：|2448724|MySQL表：|2448725|create+table+`users`+(
++++`id`+int+unsigned+not+null+auto_increment,
++++...all+user+properties...
++++`salt`+varchar(20)+not+null,
++++`pword`+blob+not+null,
++++primary+key(`id`)
)+default+charset=utf8+collate+utf8_unicode_ci;|code-block|syntax|javascript|2448726|生成新用户并创建密码：|2448727|define('SYSTEM_SALT',+'rgcaeg43cg0#3tg_..%2Bg3gg3g');+/*+A+random+system+wide+salt+*/
define('ITERATIONS',+1000);+/*+Number+of+hashing+iterations+*/
define('KEY_LENGTH',+256);+/*+Length+of+the+generated+hash+*/

...

$user+=+new+User();

$salt++=+PBKDF2::generator(15);+/*+Salt+length+is+15+characters+*/
$pword+=+PBKDF2::generator(8);+/*+User+password+length+is+8+characters+*/

$hashed_pword+=+PBKDF2::run($pword,+SYSTEM_SALT+.+$salt,+ITERATIONS,+KEY_LENGTH,+PBKDF2::SHA512);

$user->setPassword($hashed_pword);
$user->setSalt($salt);
/*+Set+the+rest+of+the+user+properties+*/|2448728|最后，在魔术发生的地方，PBKDF2类实现：|2448729|class+PBKDF2+{
++++const+SHA256+=+'sha256';
++++const+SHA512+=+'sha512';
++++const+TIGER++=+'tiger192,4';
++++const+RIPEMD+=+'ripemd256';
++++const+HAVAL++=+'haval256,5';

++++public+static+function+run($password,+$salt,+$iterations,+$key_length,+$algorithm)+{
++++++++if+(!PBKDF2::isAlgorithmAvailable($algorithm))
++++++++++++throw+new+PBKDF2Exception("Algorithm+not+available+on+your+system");

++++++++$key_blocks++=+ceil($key_length+/+strlen(hash($algorithm,+null,+true)));
++++++++$derived_key+=+'';

++++++++for+($block+=+1;+$block+<=+$key_blocks;+$block%2B%2B)+{
++++++++++++$current+=+$initial+=+hash_hmac($algorithm,+$salt+.+pack('N',+$block),+$password,+true);
++++++++++++for+($i+=+1;+$i+<+$iterations;+$i%2B%2B)+{
++++++++++++++++$current+%5E=+($initial+=+hash_hmac($algorithm,+$initial,+$password,+true));
++++++++++++}

++++++++++++$derived_key+.=+$current;
++++++++}

++++++++return+substr($derived_key,+0,+$key_length);
++++}

++++public+static+function+isAlgorithmAvailable($algorithm)+{
++++++++return+in_array($algorithm,+hash_algos());
++++}

++++public+static+function+generator($length+=+8)+{
++++++++$chars++=+'abcdefghijklmnopqrstuvwxyz0123456789?!_:;,.ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789?!_:;,.';
++++++++$buffer+=+'';

++++++++for+($i+=+0;+$i+<+intval($length);+$i%2B%2B)+{
++++++++++++$buffer+.=+$chars[mt_rand(0,+strlen($chars)+-+1)];
++++++++}

++++++++return+$buffer;
++++}
}|2448730|PBKDF的意思是Password+Based+Key+Derivation+Function，是PKCS标准的一部分。上面的类将密码哈希1000次(当然可以更高)，使用PHP中的SHA+512哈希实现(或指定的算法)和合并的两个盐类。这样，您应该对彩虹表查找非常安全，这是破解散列密码的标准方法。|offset|length|style|CODE|2448731|正如您所看到的，我还为用户生成了一个密码，这当然可以是非自动生成的，而是让用户选择自己的密码。|2448732|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/PBKDF2^0|0|0|0|0|0|0|0|0|9|12|9|12|0|0|0^^$0|@$1|2|3|4|5|6|7|18|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|19|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|1A|8|@]|9|@]|A|$]]|$1|F|3|G|5|H|7|1B|8|@]|9|@]|A|$I|J]]|$1|K|3|L|5|6|7|1C|8|@]|9|@]|A|$]]|$1|M|3|N|5|H|7|1D|8|@]|9|@]|A|$I|J]]|$1|O|3|P|5|6|7|1E|8|@]|9|@]|A|$]]|$1|Q|3|R|5|H|7|1F|8|@]|9|@]|A|$I|J]]|$1|S|3|T|5|6|7|1G|8|@$U|1H|V|1I|W|X]]|9|@$U|1J|V|1K|1|1L]]|A|$]]|$1|Y|3|Z|5|6|7|1M|8|@]|9|@]|A|$]]|$1|10|3|-4|5|6|7|1N|8|@]|9|@]|A|$]]]|11|$12|$5|13|14|15|A|$16|17]]]]

MD5 hashes are not the best way to hash passwords, it became "broken" (reversed engineered) years ago.

And just hashing a password is not a desirable security level. Using salts, hashing and iterations is. Here's the way I usually create and store a user password:

MySQL table:

<pre><code>create table `users` (
 `id` int unsigned not null auto_increment,
 ...all user properties...
 `salt` varchar(20) not null,
 `pword` blob not null,
 primary key(`id`)
) default charset=utf8 collate utf8_unicode_ci;
</code></pre>

Generating a new user and creating a password:

<pre><code>define('SYSTEM_SALT', 'rgcaeg43cg0#3tg_..+g3gg3g'); /* A random system wide salt */
define('ITERATIONS', 1000); /* Number of hashing iterations */
define('KEY_LENGTH', 256); /* Length of the generated hash */

...

$user = new User();

$salt = PBKDF2::generator(15); /* Salt length is 15 characters */
$pword = PBKDF2::generator(8); /* User password length is 8 characters */

$hashed_pword = PBKDF2::run($pword, SYSTEM_SALT . $salt, ITERATIONS, KEY_LENGTH, PBKDF2::SHA512);

$user-&gt;setPassword($hashed_pword);
$user-&gt;setSalt($salt);
/* Set the rest of the user properties */
</code></pre>

And finally, where the magic happens, the PBKDF2 class implementation:

<pre><code>class PBKDF2 {
 const SHA256 = 'sha256';
 const SHA512 = 'sha512';
 const TIGER = 'tiger192,4';
 const RIPEMD = 'ripemd256';
 const HAVAL = 'haval256,5';

 public static function run($password, $salt, $iterations, $key_length, $algorithm) {
 if (!PBKDF2::isAlgorithmAvailable($algorithm))
 throw new PBKDF2Exception("Algorithm not available on your system");

 $key_blocks = ceil($key_length / strlen(hash($algorithm, null, true)));
 $derived_key = '';

 for ($block = 1; $block &lt;= $key_blocks; $block++) {
 $current = $initial = hash_hmac($algorithm, $salt . pack('N', $block), $password, true);
 for ($i = 1; $i &lt; $iterations; $i++) {
 $current ^= ($initial = hash_hmac($algorithm, $initial, $password, true));
 }

 $derived_key .= $current;
 }

 return substr($derived_key, 0, $key_length);
 }

 public static function isAlgorithmAvailable($algorithm) {
 return in_array($algorithm, hash_algos());
 }

 public static function generator($length = 8) {
 $chars = 'abcdefghijklmnopqrstuvwxyz0123456789?!_:;,.ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789?!_:;,.';
 $buffer = '';

 for ($i = 0; $i &lt; intval($length); $i++) {
 $buffer .= $chars[mt_rand(0, strlen($chars) - 1)];
 }

 return $buffer;
 }
}
</code></pre>

PBKDF means <a href="http://en.wikipedia.org/wiki/PBKDF2" rel="nofollow"><code>Password Based Key Derivation Function</code></a>, and is a part of the PKCS standards. The class above hashes the password 1000 times (you could of course go higher), with the SHA 512 hash implementation in PHP (or your desierable algorithm) and two salts that were merged. This way you should be very secure against rainbow table lookups, which is the standard way of cracking a hashed password.

As you can see I also generate a password for the users, this could of course be non-autogenerated and instead let the users pick their own passwords.

<blockquote>
 Possible Duplicate: 
 <a href="https://stackoverflow.com/questions/2768248/is-md5-really-that-bad">Is MD5 really that bad?</a> 
</blockquote>



Hi,

I'm trying to create a fairly secure log in function. I use the md5() function to when I insert a user into a MySQL table with SQL and PHP, but the string of letters and numbers that appears in the table of that, isn't that encrypted and a fairly secure way?

Would appreciate some good advice to create a log in function. Thanks!

md5() function?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

EdgeOne AI 安全实战专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

可能重复：嗨,我正在尝试创建一个相当安全的登录函数。我使用md5()函数将用户插入使用SQL和MySQL的MySQL表中，但是该表中出现的字母和数字字符串，难道不是一种加密和相当安全的方法吗？希望有一些好的建议来创建一个登录函数。谢谢!

问md5()函数？
EN

回答 5

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问md5()函数？EN

回答 5

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问md5()函数？
EN