The status of data encryption in our lives has become increasingly important, especially given the large amount of data that is being traded and transmitted over the network. If you are interested in adopting security measures, you will also have a hobby to understand a range of security features provided by PHP. In this article, we'll cover these features and provide some basic usage so that you can add security features to your application.
Pre-knowledge
Before we introduce the security features of PHP, we need to take some time to introduce some basic knowledge about cryptography to readers who have not been exposed to this aspect, and if you are already familiar with the basic concepts of cryptography, you can jump over this part.
Cryptography can be popularly described as the study and experiment of encryption and decryption, which is the process of converting understandable data into difficult-to-understand data, and decryption is the process of converting understandable data into original understandable data. The information that is not easy to understand is called the password, and the understandable information is called the plaintext.
Data encryption/decryption requires a certain algorithm, these algorithms can be very simple, such as the famous Caesar code, but the current encryption algorithm to be relatively more complex, some of which use the existing methods even can not be deciphered.
PHP's encryption function
As long as there is a bit of experience with non-Windows platform may be quite familiar with crypt (), this function is called one-way encryption function, it can encrypt some plaintext, but not the ability to convert the password to the original plaintext. Although it appears to be a useless feature on the surface, it is widely used to ensure the integrity of the system's passwords. Because one-way encrypted passwords fall into the hands of third parties and are not much useful because they cannot be reverted to plaintext. When validating the user input password, the user's input is a one-way algorithm, if the input and stored encrypted password match, then the input message must be correct.
PHP also provides the possibility of using its crypt () function to complete a one-way encryption function. I'm going to briefly describe this function here:
String crypt (String input_string [, string salt])
The input_string parameter is a string that needs to be encrypted, and the second optional salt is a bit string that can affect the cryptographic cipher, further eliminating the possibility of being called an estimate attack. By default, PHP uses a 2-character des interference string, if your system is using MD5 (I'll introduce the MD5 algorithm later), it will use a 12-character interference string. By the way, you can find the length of the interfering string that the system will use by executing the following command:
Print "My system salt size is:". Crypt_salt_length;
Other cryptographic algorithms may also be supported by the system. Crypt () supports four algorithms, the following is the length of the algorithm it supports and the corresponding salt parameter:
Algorithm Salt length
Crypt_std_des 2-character (Default)
Crypt_ext_des 9-character
Crypt_md5 12-character beginning with $
Crypt_blowfish 16-character beginning with $
Implementing user authentication with crypt ()
As an example of the crypt () function, consider a situation where you want to create a PHP script that restricts access to a directory, only the user who is able to provide the correct user name and password to access the directory. I'm going to store the data in a table in my favorite database, MySQL. Let's start with an example of creating this table called the members:
Mysql>create TABLE Members (
->username CHAR () not NULL,
->password CHAR (+) not NULL,
->primary KEY (username)
);
We then assume that the following data is already stored in the table:
User name password
Clark Kelod1c377lke
Bruce Ba1t7vnz9awgk
Peter Paluvrwsrlz4u
These encrypted passwords correspond to the plaintext of Kent, banner, and Parker respectively. Pay attention to the first two letters of each password, because I used the following code to create a disturbance string based on the first two letters of the password:
$enteredPassword.
$salt = substr ($enteredPassword, 0, 2);
$userPswd = Crypt ($enteredPassword, $salt);
$USERPSWD is then stored in MySQL with the user name
I will use the Apache password-answer authentication configuration prompts the user to enter a user name and password, a little-known information about PHP is that it can be Apache password-answering system input username and password to identify as $php_auth_user and $PHP_AUTH_PW, I'll use these two variables in the authentication script. Take some time to read the following script carefully and pay more attention to the explanations in order to better understand the following code:
Application of Crypt () and Apache's password-response verification system
$host = "localhost";
$user = "Zorro";
$PSWD = "Hell odolly";
$DB = "Users";
Set Authorization to False
$authorization = 0;
Verify that user has entered username and password
if (Isset ($PHP _auth_user) && isset ($PHP _auth_pw)):
Mysql_pconnect ($host, $user, $pswd) or Die ("Can ' t connect to MySQL
Server! ");
http://www.bkjia.com/PHPjc/629772.html www.bkjia.com true http://www.bkjia.com/PHPjc/629772.html techarticle The status of data encryption in our lives has become increasingly important, especially given the large amount of data that is being traded and transmitted over the network. If you have a hobby for adopting safety measures ...
