php crypt password and postgresql database

Question

I'm new in PHP. I'm doing authentication, where I'm checking password with password stored in database PostgreSQL. On db site i used this function to crypt my password:

update ucty set psswd =  crypt('some_pswd',gen_salt('md5')) where uid='1';

In my PHP srcipt I'm using this code:

$query = "SELECT meno, priezvisko, nickname, psswd, uid 
          FROM ucty 
          where nickname='$nickname' and psswd=crypt('$password', psswd)";

Everything works fine, but I'm not sure , that this is correct way to secure my password.

Any advice?

You have a SQL injection vulnerability.

SLaks
– SLaks

2014-02-18 15:13:35 +00:00
Commented Feb 18, 2014 at 15:13 — SLaks
– SLaks, Commented Feb 18, 2014 at 15:13

Community · Accepted Answer · 2023-11-17 20:33:26Z

2

You're correct; this isn't the correct way to secure your password.

You're encrypting the password as part of the query. This can be logged (in plaintext), so it's very possible for intruders (or anyone listening to your traffic) to see users' passwords in plaintext.

"How can I prevent this?" Do your hashing on the server-side, within your PHP code. You can read up on this in the PHP manual.

Essentially, you want to have your query to set a password be something like this:
```
  UPDATE ucty SET psswd=$hashed WHERE uid=1;
```
You're putting variables directly into the SQL statement. You didn't mention what method you're using to query the database, but you'll want to use prepared statements. This is a safe way to slide in user-supplied data (which $nickname and $password are).

This would be an example of a good way to use prepared statements:
```
  $query = "SELECT meno, priezvisko, nickname, psswd, uid"
     . " FROM ucty"
     . " WHERE nickname=? and psswd=?";

  $stmt = $dbh->prepare($query);
  $stmt->execute(array($nickname, $hashedPassword));
```

edited Nov 17, 2023 at 20:33

CommunityBot

11 silver badge

answered Feb 18, 2014 at 15:16

Chris Forrence

10.1k11 gold badges50 silver badges66 bronze badges

Sign up to request clarification or add additional context in comments.

8 Comments

Quentin Over a year ago

You're assuming that the connection between the PHP and the database is (a) over a network and (b) not secure, and even if that is the case the attacker will still have to have compromised the LAN the servers are on.

Chris Forrence Over a year ago

@Quentin - Given the question so far, is that not a safe or reasonable assumption? And in either case the PostgreSQL log could have the plaintext log.

martinstoeckli Over a year ago

Actually i agree with your answer, but the verification cannot be done with such a query, because of the salt. Instead the password-hash can be retrieved with something like SELECT psswd FROM ucty WHERE nickname=? and then you can verify the result with password_verify().

Chris Forrence Over a year ago

@martinstoeckli Ah right, because you'd probably be storing the salt in the database as well.

martinstoeckli Over a year ago

@ChrisForrence - Yes, the salt is part of the resulting hash-value if you use the password_hash() function.

|

Collectives™ on Stack Overflow

php crypt password and postgresql database

1 Answer 1

8 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

8 Comments

Your Answer

Sign up or log in

Post as a guest

Related