encrypt with PHP MYSQL

Question

When a user registers on my site I insert their password into the database like this using the encrypt function (the database is mysql);

$qry = "INSERT INTO members(firstname, lastname, email, login, passwd) VALUES ('$fname','$lname','$email', '$login',ENCRYPT('$password'))";

When i match it when they login I use this query but it doesnt seem to be working;

$qry="SELECT * FROM members WHERE login='$login' AND passwd = ENCRYPT('$password')";

Why does this not work?

It doesn't look like you're doing ENCRYPT on the INSERT query -- can you show us where you're doing it? — Christian Ternus
– Christian Ternus, Commented Oct 24, 2013 at 22:54
In the database, do you see an encrypted password? Also, can you verify ENCRYPT(string) returns the same thing each time (I don't know how that SQL function works, maybe it uses some sort of salt) — Mike Christensen
– Mike Christensen, Commented Oct 24, 2013 at 22:57
my query does encrypt the password you just have to scroll across and yeah i see an encrypted password in the database. — Luke14
– Luke14, Commented Oct 24, 2013 at 22:58
Use crypt() with sha1() along with a "dash of salt"; that's what I use. — Funk Forty Niner
– Funk Forty Niner, Commented Oct 24, 2013 at 23:48

3 revs, 2 users 98% · Accepted Answer · 2024-10-10 15:11:08Z

3

According to encrypt documentation

ENCRYPT(str[,salt])

Encrypts str using the Unix crypt() system call and returns a binary string. The salt argument must be a string with at least two characters or the result will be NULL. If no salt argument is given, a random value is used.

Then, you are getting the same, cause each time that your are requesting the function encrypt, a new salt string is being used, probably, you need to set the salt before try it. For example, when I have tried with a salt, I have taken the result that I have looking for

SELECT ENCRYPT(  'hello',  'stringSalt' ) =  'stOIgrUfQZeZ.'

BUt, If I dont use teh salt string

select encrypt('hello');

1st result: qn8VHq6xLWgQc
2nd result: 6odpFDddcEdoA

Both result are completely different

Finally, if the crypt function is not on your OS then, result would be null

edited Oct 10, 2024 at 15:11

community wiki

3 revs, 2 users 98%
Carlos

Sign up to request clarification or add additional context in comments.

Comments

Community · Accepted Answer · 2017-05-23 11:50:05Z

0

Encrypting passwords is not easy, you should not ask on stack overflow.

This article discusses the correct approach: Secure hash and salt for PHP passwords

Do not invent this from scratch, you must an industry standard and strong method such as scrypt, bcrypt or pbkdf2 and before using them you need to study how they work and make sure you're implementing them properly.

Any questions you have about implementation should really be asked at security.stackexchange.com as stack overflow isn't really the place for security questions.

The technique you have posted so far is COMPLETELY WRONG. It can't be fixed, you need to start over from scratch and do it differently.

edited May 23, 2017 at 11:50

CommunityBot

11 silver badge

answered Oct 24, 2013 at 23:25

Abhi Beckert

33.5k12 gold badges89 silver badges115 bronze badges

Collectives™ on Stack Overflow

encrypt with PHP MYSQL

2 Answers 2

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related