[help] MySQL/PHP Check password md5

Discussion in 'PHP' started by scottlpool2003, Sep 10, 2012.

  1. #1
    Trying to check a password against MD5 in the db...

    1. Post username/password
    2. Escape special chars
    3. Encrypt password to MD5
    4. Search where = to username/password

    I've tried it with the encrypted password and without the encrypted password. Checked that it's outputting the same MD5 hash as in the db but it's still saying error. I changed the code to check if the username was found and it was so it's only the password field.

    Never worked with MD5 before so a little bit of a noob. :)

    <?php
    
    //Post variables
    $username = $_POST['username'];
    $password = $_POST['password'];
    
    //Escape variables
    mysql_real_escape_string($username);
    mysql_real_escape_string($password);
    $password = md5($password);
    
    //Connect to db
    mysql_connect("", "", "") or die(mysql_error());
    mysql_select_db("") or die(mysql_error());
    
    
    //Search for user/pass
    $result = mysql_query("SELECT * FROM users WHERE username = '$username' and password = '$password'");
    
    if(mysql_num_rows($result)!=0)
    {
    echo "Found!!";
    }
    else {
    echo "Error, there appears to be a problem with your username/password. Please <a href=\"index.php\" title=\"Go Back\">go back</a> and try again.";
    echo "<br /><br />USERNAME: $username<br />PASSWORD: $password";}
    ?>
    PHP:
     
    scottlpool2003, Sep 10, 2012 IP
  2. Arttu

    Arttu Member

    Messages:
    139
    Likes Received:
    2
    Best Answers:
    8
    Trophy Points:
    40
    #2
    It should work, are you absolutely sure that the output is the same as in the db?

    Try adding
    mysql_query("INSERT INTO users (username, password) VALUES('$username', '$password')");
    before
    $result = mysql_query("SELECT * FROM users WHERE username = '$username' and password = '$password'");
    if it still doesn't work then the problem is most likely with your db structure(is the length of the password field at least 32 chars?).
     
    Arttu, Sep 10, 2012 IP
  3. scottlpool2003

    scottlpool2003 Well-Known Member

    Messages:
    1,708
    Likes Received:
    49
    Best Answers:
    9
    Trophy Points:
    150
    #3
    Thanks

    For some strange reason, it didn't like the variable name $password... I changed it to $encryptedpass and it worked fine.
     
    scottlpool2003, Sep 11, 2012 IP
  4. plussy

    plussy Peon

    Messages:
    152
    Likes Received:
    5
    Best Answers:
    9
    Trophy Points:
    0
    #4
    is there any particular reason why you use md5? it is a very old and outdated hashing algorithm. sha1 is better but even that is not really secure anymore.
     
    plussy, Sep 11, 2012 IP
  5. scottlpool2003

    scottlpool2003 Well-Known Member

    Messages:
    1,708
    Likes Received:
    49
    Best Answers:
    9
    Trophy Points:
    150
    #5
    Good point, Plussy

    I hadn't really thought about it, I thought it was standard to encrypt with MD5 but you prompted me to read up on it. It appears that SHA1() and MD5() are both unsuitable encryption methods (for passwords). They're both easy to brute force.

    For those who come into this thread, the following article is worth a read:

    Source: http://www.php.net/manual/en/faq.passwords.php#faq.passwords.fasthash
     
    scottlpool2003, Sep 11, 2012 IP
  6. plussy

    plussy Peon

    Messages:
    152
    Likes Received:
    5
    Best Answers:
    9
    Trophy Points:
    0
    #6
    plussy, Sep 11, 2012 IP
  7. Arttu

    Arttu Member

    Messages:
    139
    Likes Received:
    2
    Best Answers:
    8
    Trophy Points:
    40
    #7
    Md5 can't be bruteforced if you add long enough salt.
     
    Arttu, Sep 11, 2012 IP
  8. plussy

    plussy Peon

    Messages:
    152
    Likes Received:
    5
    Best Answers:
    9
    Trophy Points:
    0
    #8
    plussy, Sep 11, 2012 IP
  9. Arttu

    Arttu Member

    Messages:
    139
    Likes Received:
    2
    Best Answers:
    8
    Trophy Points:
    40
    #9
    like this?
    md5($password. "this#is_salt%%12sddsadoa324121")
     
    Arttu, Sep 11, 2012 IP
  10. plussy

    plussy Peon

    Messages:
    152
    Likes Received:
    5
    Best Answers:
    9
    Trophy Points:
    0
    #10
    face the fact that md5 is outdated. if you add a 1000 long string or not. md5 is old technology and as a developer you should always try to use the latest technology.

    and yes they can be broken

    Check this link

    http://www.golubev.com/hashgpu.htm

    they were checking 42 228 252 672 passwords in 16s. at this speed yes md5 and sha1 can be broken.

    One major problem with md5 and sha1 is that they are not encrypting. they are hashing. md5 hash will be 32 digits long and sha1 will always have 40. So you will end up with multiple strings having the same hash. so in order to break the md5 you don't actually need to find the extact string. you can find another one that has the same hash.
     
    plussy, Sep 11, 2012 IP
  11. Arttu

    Arttu Member

    Messages:
    139
    Likes Received:
    2
    Best Answers:
    8
    Trophy Points:
    40
    #11
    Another string with the same hash wont work because the password gets salted every time before it's checked against the one in the db.

    
    $salt = "s21jSJaqodoXOMOZOom20sijsoasj129d0j10djajd9JD209jJ0J903JD3390D009D390J393J09dj9J9DJj9djdj1DJ1D91dj12019PDJJDJDIWRWis90jS";
    $password = md5($password.substr($salt, 0,120-strlen($password)));
    
    PHP:
    Lets say passwords are between 3 and 20 characters long, case sensitive and contain a-Z and 0-9. If we use the code above the string that would be md5 hashed woud always be 120 characters long. Since the hacker wouldn't know how long the salt is(or if there even was one) he would have to try every possible string that is at least 3 characters long.
    MSP15561a34610ffeh4460d000044h81780ffc459i0.gif
    If we add special characters that would give us even more possibilites.
     
    Arttu, Sep 11, 2012 IP
  12. scottlpool2003

    scottlpool2003 Well-Known Member

    Messages:
    1,708
    Likes Received:
    49
    Best Answers:
    9
    Trophy Points:
    150
    #12
    Now that is much more secure than MD5.

    Thanks.
     
    scottlpool2003, Sep 12, 2012 IP