homepage Welcome to WebmasterWorld Guest from 54.204.127.56
register, free tools, login, search, subscribe, help, library, announcements, recent posts, open posts,
Subscribe to WebmasterWorld

Home / Forums Index / Code, Content, and Presentation / PHP Server Side Scripting
Forum Library, Charter, Moderators: coopster & jatar k

PHP Server Side Scripting Forum

    
'Forgotten password' script
hannahd




msg:1316470
 2:15 pm on Sep 2, 2004 (gmt 0)

Hello,

I need to be able to send automatic emails to users on my website who have forgotten their passwords. I have a few questions:

The passwords are stored in a MySQL database using the MD5() function. I understand this is one-way encryption. Is there a way for it to be de-encrypted by a PHP script?

Secondly, I have no clue whatsoever about sending automated emails, and I was wondering what my options are? Is my host likely to support sending automatic emails? And where could I learn about how to send them?

Thanks in advance :)

Hannah

 

Knowles




msg:1316471
 2:33 pm on Sep 2, 2004 (gmt 0)

hannahd welcome to WebmasterWorld!

As far as I know there is no way to decrypt md5 passwords, your best bet would be to have a secure page that would be linked from the email where they could reset the password to something different. Possibly include a security question. Mothers madien name something like that.

with php mail() [us4.php.net] would be your best bet. Its not overly hard to use. Follow the link and it will take you the the php manual.

hannahd




msg:1316472
 2:37 pm on Sep 2, 2004 (gmt 0)

Thanks very much, Knowles. :)

Very useful. :)

ergophobe




msg:1316473
 3:06 pm on Sep 2, 2004 (gmt 0)

Welcome hannahd,

First, no, you cannot undo an MD5 hash. If you find the alogrithm to do so, you can receive a ten thousand dollar prize. So what you will need to do is,
- generate a random password
- reset the password in the DB to the new random password
- perhaps set a time limit for the user to log in with the new password and reset it.
- send the password to the user.

For the random password part, just google on "php random password" and you'll find several short scripts that will do that for you.

Then you update the DB with the new password and get the user's email from the DB.

Use the php mail() [php.net] function to send the mail.

That should get you started.

Tom

hannahd




msg:1316474
 5:03 pm on Sep 2, 2004 (gmt 0)

Thanks Tom :)

It must be possible to de-encrypt the MD5 value as when the user logs on with his password, it will be in English. It is obviously matched up against the MD5 value, so it's finding the key somewhere.

coopster




msg:1316475
 6:25 pm on Sep 2, 2004 (gmt 0)

Nope. What happens is the password that the user entered is encrypted and the two encrypted values are compared.

Knowles




msg:1316476
 7:01 pm on Sep 2, 2004 (gmt 0)

yeah make sure the db field where it is stored is long enough... it will save you hours even days in my cause of debugging trying to figure out why the passwords dont match.

hannahd




msg:1316477
 7:20 pm on Sep 2, 2004 (gmt 0)

I made it a varchar field of size 50. I have also made it so the passwords are never any longer than 10 characters. Is this okay?

ergophobe




msg:1316478
 8:31 pm on Sep 2, 2004 (gmt 0)

Actually, the length of the password and the length of the field are totally independent.

A common use for md5 is to verify that a file has survived transfer without corruption. So I can do an md5 hash of a 10GB file and it will be 32 characters. If I do a md5 hash of nothing at all, I get a 32-character string as well. So your password field, if using the php md5() function, should have a length of 32.

Tom

dcrombie




msg:1316479
 10:40 am on Sep 3, 2004 (gmt 0)

You're very brave if you set it to 32 exactly. I made that mistake when crypt used standard DES encryption (13 chars).

The site stopped working entirely when moved to another server and was a PITA to debug.

ergophobe




msg:1316480
 2:06 pm on Sep 3, 2004 (gmt 0)

That's why I specified, if using md5(), not crypt() which will depend on various things. According to the manual for md5(),


The hash is a 32-character hexadecimal number

The md5 spec merely requires that it be a 128-bit hash, but the php manual (I guess it's not a spec) says that output will be 32 characters unless you are using PHP5 and use the "raw_output" parameter, in which case it will be 16 characters.

Global Options:
 top home search open messages active posts  
 

Home / Forums Index / Code, Content, and Presentation / PHP Server Side Scripting
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved