PHP实现带密码验证的账号删除功能：切换password_hash后代码适配问题

云原生阿岚

2026-10-7

正确适配password_hash的修改方案

核心错误点

password_verify() 函数返回的是布尔值（true/false），不是加密后的哈希串，你把它作为参数传到SQL里和数据库存储的哈希比对，逻辑完全不成立
password_hash 生成的哈希默认会随机加盐，每次计算结果都不同，无法直接用WHERE password = xxx的SQL语句做等值查询，必须先取出对应用户的存储哈希再做校验

修正后的完整代码

if(!empty($_POST['delete'])){
    if(empty($_POST['currentpassword'])) {
        $error = error('Please enter current password.');
    }

    // 仅根据用户ID查询对应存储的密码哈希
    $SQLCheckCurrent = $odb -> prepare("SELECT `password` FROM `users` WHERE `ID` = :ID LIMIT 1");
    $SQLCheckCurrent -> execute(array(':ID' => $_SESSION['ID']));
    $storedHash = $SQLCheckCurrent -> fetchColumn();

    // 用password_verify校验提交的明文密码和存储哈希是否匹配
    if (!$storedHash || !password_verify($_POST['currentpassword'], $storedHash)){
        $error = error('Current password is incorrect.');
    }
    
    $notify = error($error);

    if(empty($error)){
        $SQLUpdate = $odb -> prepare("DELETE FROM `users` WHERE `username` = :username AND `ID` = :id");
        $SQLUpdate -> execute(array(':username' => $_SESSION['username'], ':id' => $_SESSION['ID']));
        session_destroy();
        header("location: login");
        die();
    }
}