PHP用户编辑页面：如何显示明文密码而非数据库哈希值

首先需要明确：哈希加密是单向不可逆的，无法从数据库中存储的哈希密码还原出明文密码，因此“直接显示真实明文密码”的需求从技术逻辑上无法实现。但可以通过调整代码逻辑优化用户体验，避免显示无意义的哈希值，同时保证密码修改功能正常运行。

核心优化思路 #

1. 编辑页面加载时，密码输入框不填充数据库中的哈希值，改为留空或显示提示文本
2. 处理更新请求时，仅当用户输入了新密码时才更新密码字段；若输入框为空，则保留原密码不变

修改后的代码实现 #

1. 前端密码输入框调整

将原密码输入框的赋值逻辑移除，改为提示文本：

<input type="password" name="user_password" placeholder="输入新密码以修改，留空则保持原密码">

2. PHP后端逻辑修改

重点调整密码更新的判断逻辑，同时修复原代码中取盐的错误（原代码取全局用户的盐，应取当前编辑用户的盐）：

<?php

if(isset($_GET['edit_user'])){
    $the_user_id = $_GET['edit_user'];

    $query = "SELECT * FROM users WHERE user_id = $the_user_id ";
    $select_user_by_id = mysqli_query($connection, $query);
    test_query($select_user_by_id);

    while($row = mysqli_fetch_assoc($select_user_by_id)){
        $user_id = $row['user_id'];
        $user_username = $row['user_username'];
        $user_firstname = $row['user_firstname'];
        $user_lastname = $row['user_lastname'];
        $user_image = $row['user_image'];
        $user_email = $row['user_email'];
        // 不再将哈希密码赋值给$user_password，避免前端显示
        $user_role = $row['user_role'];
    }

    if(isset($_POST['update_user'])){
        $user_username = $_POST['user_username'];
        $user_firstname = $_POST['user_firstname'];
        $user_lastname = $_POST['user_lastname'];
        $user_image = $_FILES['user_image']['name'];
        $user_image_temp = $_FILES['user_image']['tmp_name'];
        $user_email = $_POST['user_email'];
        $user_password = trim($_POST['user_password']); // 去除首尾空格，判断是否为空
        $user_role = $_POST['user_role'];

        move_uploaded_file($user_image_temp, "../images/$user_image");

        if(empty($user_image)){
            $query = "SELECT * FROM users WHERE user_id = $the_user_id ";
            $select_image = mysqli_query($connection, $query);
            while($row = mysqli_fetch_assoc($select_image)){
                $user_image = $row['user_image'];
            }
        }

        // 构建基础更新SQL
        $query = "UPDATE users SET ";
        $query .= "user_username = '{$user_username}', ";
        $query .= "user_firstname = '{$user_firstname}', ";
        $query .= "user_lastname = '{$user_lastname}', ";
        $query .= "user_image = '{$user_image}', ";
        $query .= "user_email = '{$user_email}', ";
        $query .= "user_role = '{$user_role}' ";

        // 仅当用户输入新密码时，才更新密码字段
        if(!empty($user_password)){
            // 取当前编辑用户的盐值
            $query_salt = "SELECT user_randomhash FROM users WHERE user_id = $the_user_id ";
            $select_rand_query = mysqli_query($connection, $query_salt);
            $row = mysqli_fetch_array($select_rand_query);
            $salt = $row['user_randomhash'];
            $hashed_password = crypt($user_password, $salt);

            // 调整SQL语句，添加密码更新字段
            $query = str_replace("user_role = '{$user_role}' ", "user_role = '{$user_role}', ", $query);
            $query .= "user_password = '{$hashed_password}' ";
        }

        $query .= "WHERE user_id = {$the_user_id} ";

        $update_users = mysqli_query($connection, $query);
        test_query($update_users);
        header("Location: users.php?source=edit_user&edit_user=$user_id");
    }
}

?>

优化效果说明 #

• 编辑页面打开时，密码输入框不再显示哈希值，用户体验更友好
• 用户可以选择输入新密码修改，或留空保持原密码不变
• 密码哈希加密的安全机制完全保留，不会降低系统安全性

内容的提问来源于stack exchange，提问作者Equinius