Welcome to WebmasterWorld Guest from 184.108.40.206
I need to be able to send automatic emails to users on my website who have forgotten their passwords. I have a few questions:
The passwords are stored in a MySQL database using the MD5() function. I understand this is one-way encryption. Is there a way for it to be de-encrypted by a PHP script?
Secondly, I have no clue whatsoever about sending automated emails, and I was wondering what my options are? Is my host likely to support sending automatic emails? And where could I learn about how to send them?
Thanks in advance :)
As far as I know there is no way to decrypt md5 passwords, your best bet would be to have a secure page that would be linked from the email where they could reset the password to something different. Possibly include a security question. Mothers madien name something like that.
with php mail() [us4.php.net] would be your best bet. Its not overly hard to use. Follow the link and it will take you the the php manual.
First, no, you cannot undo an MD5 hash. If you find the alogrithm to do so, you can receive a ten thousand dollar prize. So what you will need to do is,
- generate a random password
- reset the password in the DB to the new random password
- perhaps set a time limit for the user to log in with the new password and reset it.
- send the password to the user.
For the random password part, just google on "php random password" and you'll find several short scripts that will do that for you.
Then you update the DB with the new password and get the user's email from the DB.
Use the php mail() [php.net] function to send the mail.
That should get you started.
A common use for md5 is to verify that a file has survived transfer without corruption. So I can do an md5 hash of a 10GB file and it will be 32 characters. If I do a md5 hash of nothing at all, I get a 32-character string as well. So your password field, if using the php md5() function, should have a length of 32.
The hash is a 32-character hexadecimal number
The md5 spec merely requires that it be a 128-bit hash, but the php manual (I guess it's not a spec) says that output will be 32 characters unless you are using PHP5 and use the "raw_output" parameter, in which case it will be 16 characters.