[Sir-Teabag]

I'm not really sure what the proper term is for this. parse? idk
anyway i'm trying to get $username and $password from config.php in to this index.php

the variables are defined in the previous directory in the config (hence the ..\config.php)

Spoiler (Click to View)

Code

<?php
  include '..\config.php';
echo '<form action="" method="POST">User: <input type="text" name="user" /><br />Pass: <input type="password" name="pwd" /><input type="submit" name="submit" style="display:none;"/></form>';
        if(isset($_POST['submit'])){
            $user = md5($_POST['user']);
            $pwd = md5($_POST['pwd']);}
            if($user == '$username' && $pwd == '$password'){
                echo "";
            }
            else{
                echo 'Login failed. Incorrect password.';
                exit;
            }
?>

this is what i have in my config.php

Code

$username_unhash = 'ttt';
$password_unhash = 'ttt123';

$username='md5($username_unhash)';
$password='md5($password_unhash)';

i'd like the username and password to be hashed first through md5. problem is it's not hashing, and i dont even know what is? I tried a few differnt things over the course of an hour and couldn't seem to get it. If someone here could point me in the right direction? that'd be so much appreciated!

(there's no errors on the page either lol)

cheers.

[DashPHP]

So here are some helpful things you should know about PHP:

PHPs quote system is quite cool, you can be literate or express variables in strings.

If you use a double quote ("), and in the string it contains variables, PHP will evaluate the variable and returns its value associated to it; for example;

PHP Code


<?php 
$name = 'DharmeshPHP';
// WITH double quotes 
echo "hey, my name is $name"; // Hey, my name is DharmeshPHP 

// WITH single quotes
echo 'hey, my name is $name'; // Hey, my name is $name 


So in your code I can see you are attempting to compare $user with $username. Remember the quote rules? you are literally asking PHP to see if the value of $user is equal to the string "$username". We want to evaluate the variable and since we're not outputting data, we can remove the quotes and it should look like :

PHP Code


<?php 
if($user == $username && $pwd == $password){ 


I think $user and $pass are being hashed with md5 from the looks of the code, however md5 is discouraged. Checkout out PHP's password_hash function.

edit: don't forget to edit your config file as well

PHP Code


<?php 
$username='md5($username_unhash)'; 


I'll let you try fix this one ;)

[Two-Ton 21]

So here are some helpful things you should know about PHP:

PHPs quote system is quite cool, you can be literate or express variables in strings.

If you use a double quote ("), and in the string it contains variables, PHP will evaluate the variable and returns its value associated to it; for example;

PHP Code


<?php 
$name = 'DharmeshPHP';
// WITH double quotes 
echo "hey, my name is $name"; // Hey, my name is DharmeshPHP 

// WITH single quotes
echo 'hey, my name is $name'; // Hey, my name is $name 


So in your code I can see you are attempting to compare $user with $username. Remember the quote rules? you are literally asking PHP to see if the value of $user is equal to the string "$username". We want to evaluate the variable and since we're not outputting data, we can remove the quotes and it should look like :

PHP Code


<?php 
if($user == $username && $pwd == $password){ 


I think $user and $pass are being hashed with md5 from the looks of the code, however md5 is discouraged. Checkout out PHP's password_hash function.

edit: don't forget to edit your config file as well

PHP Code


<?php 
$username='md5($username_unhash)'; 


I'll let you try fix this one ;)

What if your username is "true"? Should use '===' instead.

Md5 isn't secure so there's no point in using it. To compare passwords hashed via password_hash() you use password_verify().

[DashPHP]

What if your username is "true"? Should use '===' instead.

Based on that condition, you are right. I have never encountered a username to be a boolean, but thanks for clarifying!

[Sir-Teabag]

So here are some helpful things you should know about PHP:

PHPs quote system is quite cool, you can be literate or express variables in strings.

If you use a double quote ("), and in the string it contains variables, PHP will evaluate the variable and returns its value associated to it; for example;

PHP Code


<?php 
$name = 'DharmeshPHP';
// WITH double quotes 
echo "hey, my name is $name"; // Hey, my name is DharmeshPHP 

// WITH single quotes
echo 'hey, my name is $name'; // Hey, my name is $name 


So in your code I can see you are attempting to compare $user with $username. Remember the quote rules? you are literally asking PHP to see if the value of $user is equal to the string "$username". We want to evaluate the variable and since we're not outputting data, we can remove the quotes and it should look like :

PHP Code


<?php 
if($user == $username && $pwd == $password){ 


I think $user and $pass are being hashed with md5 from the looks of the code, however md5 is discouraged. Checkout out PHP's password_hash function.

edit: don't forget to edit your config file as well

PHP Code


<?php 
$username='md5($username_unhash)'; 


I'll let you try fix this one ;)

Broooo thank you so much! I really appreciate this reply, it helps me out a lot! I'll let you know on Wednesday how it goes ;D

(I'd plus rep you if I could but for now you can have all my Byte things, if i can even transfer that lmao)

[Sir-Teabag]

So here are some helpful things you should know about PHP:

PHPs quote system is quite cool, you can be literate or express variables in strings.

If you use a double quote ("), and in the string it contains variables, PHP will evaluate the variable and returns its value associated to it; for example;

PHP Code


<?php 
$name = 'DharmeshPHP';
// WITH double quotes 
echo "hey, my name is $name"; // Hey, my name is DharmeshPHP 

// WITH single quotes
echo 'hey, my name is $name'; // Hey, my name is $name 


So in your code I can see you are attempting to compare $user with $username. Remember the quote rules? you are literally asking PHP to see if the value of $user is equal to the string "$username". We want to evaluate the variable and since we're not outputting data, we can remove the quotes and it should look like :

PHP Code


<?php 
if($user == $username && $pwd == $password){ 


I think $user and $pass are being hashed with md5 from the looks of the code, however md5 is discouraged. Checkout out PHP's password_hash function.

edit: don't forget to edit your config file as well

PHP Code


<?php 
$username='md5($username_unhash)'; 


I'll let you try fix this one ;)

Got it all working perfectly, thanks again man! Also the reason i'm using md5 is because i'm lazy and i've actually already got an IP blacklist on the directory (in the .htaccess). So the chances of someone trying to crack it are low enough but someone on your same network would be even lower. ;p

[DashPHP]

Got it all working perfectly, thanks again man! Also the reason i'm using md5 is because i'm lazy and i've actually already got an IP blacklist on the directory (in the .htaccess). So the chances of someone trying to crack it are low enough but someone on your same network would be even lower.  ;p

Glad you got it resolved!

Bro if i’m honest you might as well spend 15 minutes learning to use password_hash. Stronger hashing algorithms and also good practice. One of my biggest regrets was not moving on. I too stuck with md5 without even bothering to read on encryption. I’m happy i have changed for the better with my coding habbits. You’ll adapt to it eventually, just make it sooner than later :)

[Sir-Teabag]

Glad you got it resolved!

Bro if i’m honest you might as well spend 15 minutes learning to use password_hash. Stronger hashing algorithms and also good practice. One of my biggest regrets was not moving on. I too stuck with md5 without even bothering to read on encryption. I’m happy i have changed for the better with my coding habbits. You’ll adapt to it eventually, just make it sooner than later :)

haha alright man i'll take your word for it then. for this project though i dont think even hashing at all is necessary, i'll send you the Github link when it's up and you'll see what i mean.

[DashPHP]

haha alright man i'll take your word for it then. for this project though i dont think even hashing at all is necessary, i'll send you the Github link when it's up and you'll see what i mean.

Ahh them ones yeah. :p

Cool no worries. Good luck pal