comparing hashed strings

Question

I'm pulling my hair out with this one. I am storing a hashed salted password and the related salt in a MySQL db. It is for a login script. Storing the data works fine, with the data being stored in CHAR(128) type on the db.

However, when I cannot successfully match the password string to the hashed login password from my login form. I've stripped everything down to basic and it still doesn't match even though the output (echo or var_dump) looks identical.

Here is the register code snippet:

$_POST['dk_username'] = mysql_real_escape_string($_POST['dk_username']);
$_POST['dk_password'] = mysql_real_escape_string($_POST['dk_password']);
$username = stripslashes($_POST['dk_username']);
$password = stripslashes($_POST['dk_password']);

$salt = uniqid(mt_rand());
$newhash= $salt . $password;
$hashPass= hash('sha512', $newhash);

$email=$_POST['email'];

$sql="INSERT INTO users (uName,uPass2,uEmail,uSalt,uID)
VALUES ('$username','$hashPass','$email', '$salt', 'time()')";

mysql_query($sql) or die('Error, insert query failed');

Here is the login snippet:

$_POST['dk_username'] = mysql_real_escape_string($_POST['dk_username']);
$_POST['dk_password'] = mysql_real_escape_string($_POST['dk_password']);
$username = stripslashes($_POST['dk_username']);
$password = stripslashes($_POST['dk_password']);


$query = "SELECT uID, uPass2, uSalt, uName FROM users WHERE uName = '$username';"; 
$result = mysql_query($query); 
if(mysql_num_rows($result) < 1) //no such user exists 
{     echo 'Wrong username and/or password!'; 
} 
$userData = mysql_fetch_array($result, MYSQL_ASSOC); 
$salt=$userData['uSalt'];
$newhash= $salt . $password;
$hashPass= hash('sha512', $newhash);
$tempData=strcmp($hashpass, $userData['uPass2']);
if(hashPass != $userData['uPass2']){
echo "password not correct:<br/>";
echo "db: " . var_dump($userData['uPass2']) . "<br />";
echo "in: " . var_dump($hashPass) . "<br />; 
echo $tempData . "<BR />";

}else{
echo "logged in";
}

Result for login:

password not correct:
string(128) "98f713244f3d97e8629222f8d37e3cad38c5c1e2fbf011c135723f36b7841ef29785b1866ac6dbab9cd044b12db8e4d16a4c68df1e3d7b8f4a27a8c3d4c9bca5" db: 
string(128) "98f713244f3d97e8629222f8d37e3cad38c5c1e2fbf011c135723f36b7841ef29785b1866ac6dbab9cd044b12db8e4d16a4c68df1e3d7b8f4a27a8c3d4c9bca5" in: 
-128

BoltClock · Accepted Answer · 2010-12-31 19:16:27Z

3

Your $ is missing here for $hashPass:

if(hashPass != $userData['uPass2']){

Currently it's causing PHP to compare $userData['uPass2'] with a constant called hashPass (which PHP treats as the string 'hashPass' if the constant isn't defined).

Setting error_reporting to include E_NOTICE would have caused PHP to spit a notice about the "constant".

answered Dec 31, 2010 at 19:16

BoltClock

728k165 gold badges1.4k silver badges1.4k bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

comparing hashed strings

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related