+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Web Development (https://hackforums.net/forumdisplay.php?fid=183)
+---- Thread: [PHP] Login page - Decrypt password & Login (/showthread.php?tid=3568754)
Login page - Decrypt password & Login - magiC* - Jun 22, 2013
Hello.
That's the function I use to store the password in my Database + I did Salted it. You can see the function. Registration works perfectly.
reg.php
PHP Code
<?php
if ($username == '' or $secanswer !== 'Russia' ){
echo '<br><b>Mistake try again.</b>';
}else{
$salt = dechex(mt_rand(0,4321)) .dechex(mt_rand(0,4321));
$password = hash('sha256',$_POST['password']. $salt);
}
for ($round = 0; $round < 651255; $round++){
$password = hash('sha256',$password . $salt);
}
Now comes the part that I don't really understand... login.php
I want to log in , and if password and username are correct I will be redirected to xyz.php , that has if isset function , that checks the user if he is really logged in.
Any idea how I could make simple login page? I would appreciate small snippet etc...
I use mysqli
Thanks !
* - norboost - Jun 22, 2013
You aren't supposed to decrypt the stored password. Take the user inputted password, do the same hashing as you did when you stored it, and compare the values.
Or better yet, use bcrypt, which will be standard in PHP 5.5. If you're using a newer version than 3.4.7 there's a class you can download to get the standarized support for it, while waiting for the next PHP version.
http://php.net/manual/en/function.password-hash.php
https://github.com/ircmaxell/password_compat
* - 0x42 - Jun 22, 2013
Your code won't work.
PHP Code
<?php
$salt = dechex(mt_rand(0,4321)) .dechex(mt_rand(0,4321));
So let's see :
If you'd hash a password and store it in the database with the salt "d86d86", assuming the password is "MyRand0mF@gP@$$w0rd".
The result would be : "6d49e4fed5fd2a4b2722158bc59f804ca020e32c25463b0b4bd98efef16a4e9598bdbe5e552cbf3316f1557158592c29e6a00c8375135d20b50cbb9ae0fcb51f".
However, the next time the user would login, a new salt would be generated, "631631" for the example. The same password ("MyRand0mF@gP@$$w0rd") hashed with "631631" as salt would give :
"f3f63a9418c3646951276e50293a149a9c61c34f54e8cb1233255db9f0b03d55e6f2b1bedb1aff945d34fe535762b9fee78cf1d717529706c9dbca83032edf3c"
These two hashes (the stored one and the one that the user submitted) aren't equal, so even if the passwords are the same, as the salt differs they differ too.
Also, as stated norboost, you don't decrypt hashes. You hash the password submitted by the user and you compare it to the one stored in the database. If they are the same, then the user submitted the good password.