authenticating problem when encrypting with md5

[fatthumb]

Ok, so using PHP/MySQL I have successfully made a login page, pages that restrict access to certain user types (all using server behaviors). It works great! Although I've noticed something interesting. The passwords when stored in my MySQL database are in plain language. How can I encrypt them so that no one can see the list of passwords?
then I found out about md5 encryption.It does the job on the registration page inserting it in the database but the problem now is when I try to log in the md5 piece just doesn't work...

here is the code for the login page
Ok I think if I get this sorted out I should be good. I figured out how to encrypt the password, then put in the db. Problem is in authentication. Here's my code for the login page (this was generated by DreamWeaver):

<?php require_once('Connections/RegConnect.php');?>
<?php
// *** Validate request to login to this site.
session_start();

$loginFormAction = $_SERVER['PHP_SELF'];
if (isset($accesscheck)) {
$GLOBALS['PrevUrl'] = $accesscheck;
session_register('PrevUrl');
}

if (isset($_POST['username'])) {
$loginUsername=$_POST['username'];
$password=md5($_POST['password']); <=== RIGHT HERE?!? this is where it should go?
$MM_fldUserAuthorization = "access";
$MM_redirectLoginSuccess = "congrats.php";
$MM_redirectLoginFailed = "failed.html";
$MM_redirecttoReferrer = false;
mysql_select_db($database_RegConnect, $RegConnect);

$LoginRS__query=sprintf("SELECT username, password, access FROM users WHERE username='%s' AND password='%s'",
get_magic_quotes_gpc()? $loginUsername : addslashes($loginUsername), get_magic_quotes_gpc()? $password : addslashes($password));

$LoginRS = mysql_query($LoginRS__query, $RegConnect) or die(mysql_error());
$loginFoundUser = mysql_num_rows($LoginRS);
if ($loginFoundUser) {

$loginStrGroup = mysql_result($LoginRS,0,'access');

//declare two session variables and assign them
$GLOBALS['MM_Username'] = $loginUsername;
$GLOBALS['MM_UserGroup'] = $loginStrGroup;

//register the session variables
session_register("MM_Username");
session_register("MM_UserGroup");

if (isset($_SESSION['PrevUrl']) && false) {
$MM_redirectLoginSuccess = $_SESSION['PrevUrl'];
}
header("Location: " . $MM_redirectLoginSuccess );
}
else {
header("Location: ". $MM_redirectLoginFailed );
}
}
?>

[omoutop]

Try this one as alternative

$password=$_POST['password']; // submit from form

in your query ...
SELECT * FROM [table] WHERE password=password($password)
INSERT INTO [table] (password) VALUES (password($password))

This works the same

[FiRe]

Just to clear a few things up...

MD5 is a one-way encryption, this means that there is no decryption code for it (this is what makes it so popular). So when a user registers on your site, you should encrypt their password in md5 and insert that into your database (along with the rest of their details). Then when a user logs in, you simply encrypt the password they have entered in the form, and match it with the encrypted password in the database.

The only problem you will find is if people forget their passwords. The best thing to do in this scenario is to generate a new random password, encrypt it, replace that with their current password in the database, and then mail them the new password. I would do it like this:

$newpass = rand(1000,9999);
$newpass_encrypted = md5($newpass);

mysql_query("UPDATE users SET password='$newpass_encrypted' WHERE email='$email'");

mail($email, "New Password", "Your password has been reset to: $newpass");

Hope that helps :-)

[Kroegen]

Hello,

Could you explain this in lamens terms?

Kroegen.

[cameraman]

fatthumb, my guess is that while you were working the bugs out you accidentally encoded the password twice. Write a short script to md5 a form field and echo it to the screen, paste that value into the database record, then see if your posted script starts working.
<?php
if(isset($_POST['Submit']))
echo md5($_POST['password']) . '<br>';
?>
<form method="post" action="<?php echo $_SERVER['PHP_SELF'];?>">
<input type="text" name="password">
<input type="submit" name="Submit" value="Submit">
</form>

This works the same

Insofar as it produces a one-way encryption, but the mysql password() function doesn't use the md5 algorithm. It may be stronger but IMHO is less portable, and when they up and changed it in 4.1.1 that's a little scary. I'd rather be the one to decide when I have to rewrite my scripts.

Kroegen, welcome to WebmasterWorld.
md5 is one-way, meaning that something run through it gets mangled up in a way that can't be undone. It's easier to look at if we use very simple math. Say you have a function that divides a number by 11 and returns an integer result. The number 36 then becomes 3. You can't take the 3 and multiply it by 11 to get back to 36. MD5 does that on a much higher level, turning input into a 128 bit value that's broken up into 32 hex digits. You might notice that the divide-by-11 function will return the same result for any number from 33 to 42. MD5 has the same problem, but the same result is only obtained in 2⁴² tries.

Using a one-way encryption is good for things like people's passwords because you don't have any need to know what the original word is, and since people tend to use the same password for more than one purpose you do them a disservice by storing it plain text. FiRe pointed out that the disadvantage is that when people forget their passwords, you can't tell them what the password was, so the alternative is to generate a new one and email it. The user could then use that password to log in and change it to something easier to remember.

[fatthumb]

Thanks guys,
This forum is really helpfull. I found the problem, it was a human error(me being the naive human).The answer was on my table in the database while my password login form was spitting 32 characters hash my table column had a VARCHAR of 10 therefore the values didn't match. All I did was to set the VARCHAR to 32 and problem solved, now we have a match.
Thanks everybody.
I hope my problem-solution helps more people like me.

[Kroegen]

Thanks Cameraman, that cleared it up for me.

Kroegen.