我正在比較base64_encode md5在不同域上使用相同值（IP、時間、路徑和密碼）創建的兩個密鑰。在第一個域上創建加密密鑰 $secret = "PASSWORD"; $expires = time()+3600; $uri = '/video1/'; $ip = $_SERVER['REMOTE_ADDR']; $md5 = base64_encode(md5($secret . $expires . $uri . $ip, true)); $md5 = strtr($md5, '+/', '-_'); $md5 = str_replace('=', '', $md5); $rtmp = "?md5=".$md5; $urls= 'http://example.com'.$uri .$rtmp; echo '<a href="' . $urls . '">' .$urls . '</a>';在第二個域上創建加密密鑰并與收到的 URL 密鑰進行比較 function getAddress() { $protocol = $_SERVER['HTTPS'] == 'on' ? 'https' : 'http'; return $protocol.'://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']; } $url = getAddress(); $path = (parse_url($url, PHP_URL_PATH)); // recive path here '/video1/' $verify = substr(parse_url($url, PHP_URL_QUERY),4); //recive md5 encoded key from URL /* create again md5 encoded key to match with URL key */ $secret = "PASSWORD"; $expires = time()+3600; $uri = $path; $ip = $_SERVER['REMOTE_ADDR']; $md5 = base64_encode(md5($secret . $expires . $uri . $ip, true)); $md5 = strtr($md5, '+/', '-_'); $md5 = str_replace('=', '', $md5); $rtmp = $md5; if ($rtmp===$verify){ // Matching both, local key with URL key echo '<h1>Welcome</h1>'; } else { echo '<h1>Password,Time,Path or IP Not Match</h1>'; }我在加密中使用了 time(3600)，所以if語句應該顯示 3600 秒的值。但這總是顯示else價值。這將如何打印if時間值（3600）？在那之后打印else
2 回答
守著星空守著你
TA貢獻1799條經驗 獲得超8個贊
也許超出了問題的范圍，但整個MD5方法是有缺陷的，所以為什么不去“全力以赴”（俗話說）并實際使用加密而不是問題中的散列？
的encrypt和decrypt在用于PHP手動功能是基于代碼中發現openssl_encrypt
function encrypt( $data=false, $pubkey=false, $cipher='AES-128-CBC' ){
if( !empty( $data ) && in_array( $cipher, openssl_get_cipher_methods() ) ){
$ivlen = openssl_cipher_iv_length( $cipher );
$iv = openssl_random_pseudo_bytes( $ivlen );
$encrypted = openssl_encrypt( $data, $cipher, $pubkey, $options=OPENSSL_RAW_DATA, $iv );
$hash = makehash( $encrypted, $pubkey );
return base64_encode( $iv . $hash . $encrypted );
}
return false;
}
function decrypt( $data, $pubkey=false, $cipher='AES-128-CBC' ){
if( !empty( $data ) && in_array( $cipher, openssl_get_cipher_methods() ) ){
$shalength=32;
$data = base64_decode( $data );
$ivlen = openssl_cipher_iv_length( $cipher );
$iv = substr( $data, 0, $ivlen );
$hash = substr( $data, $ivlen, $shalength );
$encrypted = substr( $data, $ivlen + $shalength );
$decrypted = openssl_decrypt( $encrypted, $cipher, $pubkey, $options=OPENSSL_RAW_DATA, $iv );
if( $decrypted && hash_equals( $hash, makehash( $encrypted, $pubkey ) ) ){
return $decrypted;
}
}
return false;
}
function makehash( $data, $key ){
return hash_hmac( 'sha256', $data, $key, true );
}
然后，使用它：
$lifetime=3600;
$key='A complex secret string - ideally this will be the contents of an ssl cert perhaps obtained using file_get_contents etc';
$cipher='AES-128-CBC';
/* Create the payload of items to be encrypted and passed in the url */
$payload=array(
'endpoint' => '/secret-forum/topic404',
'expires' => time() + $lifetime,
'ip' => $_SERVER['REMOTE_ADDR']
);
/* create a nice string to be encrypted */
$data=urldecode( http_build_query( $payload ) );
/* create the encrypted data string */
$encrypted=encrypt( $data, $key, $cipher );
/* construct the url to be presented to the user */
$url=sprintf( '%s://%s/?hash=%s', $_SERVER['REQUEST_SCHEME'], $_SERVER['HTTP_HOST'], $encrypted );
printf('<a href="%1$s" target="_blank">%1$s</a>', $url);
/* At the Server - To process the url and check validity */
$querystring = parse_url( $url, PHP_URL_QUERY );
if( !empty( $querystring ) ){
list( $param, $data )=explode( '=', $querystring );
/* decrypt data */
$decrypted=decrypt( $data, $key, $cipher );
if( $decrypted ){
/* process initial querystring we created - create an array $out */
parse_str( $decrypted, $out );
/* for simplicity, cast as an object to use object notation */
$obj=(object)$out;
$endpoint=$obj->endpoint;
$expires=$obj->expires;
$ip=$obj->ip;
/* perform logic tests on the decrypted data and act accordingly */
if( time() > $expires or $ip!=$_SERVER['REMOTE_ADDR'] ){
/* too late */
printf( '<h1>That link has now expired</h1><p>You are no longer premitted to access that resource</p>' );
} else {
/* all good */
printf( '<h1>Welcome</h1><p>%s</p>', $obj->endpoint );
}
}
}
至尊寶的傳說
TA貢獻1789條經驗 獲得超10個贊
我沒有復制你代碼的所有部分，但這是原則。
將密碼和時間分開散列，這樣您就可以確保密碼正確并獨立查看時間。
$secret = "PASSWORD";
$expires = time()+3600;
$urls= 'http://example.com?md5=" . md5($secret) . "&t=" . md5($expires);
這將獨立傳遞它們，在接收端您將密碼與密碼匹配，然后循環時間查看它是否有效。
if($_GET['md5'] == $password) $validM = true;
for($i = time()+3600; $i>time(); $i--){
if(md5($i) == $_GET['t']) $validT = true;
}
if($validM && $validT){
echo "within 3600 seconds and correct password";
}
對于世界上大約 95% 的人口來說，這是一種安全的方法，但由于我們通過 GET 傳遞密碼和時間變量，因此弄清楚如何獲得非法訪問并不難。
如果它需要安全事務，您正在使用它，則不要使用此方法。
- 2 回答
- 0 關注
- 182 瀏覽
添加回答
舉報
0/150
提交
取消