php password check with hash doesn't work

Question

I write a login page and a checking page in php. On my local machine it work, but on the server it doesn't (if it matter I'm on Windows and the server is on Linux).

Here is the code in the checking page:

$user = $_POST['userName'];
$pass = $_POST['pass'];

$saltSQL = 'SELECT salt FROM agents WHERE name="' . $user . '"';
$saltResult = mysql_fetch_array(mysql_query($saltSQL));
$salt = $saltResult['salt'];

$passToCheck = hash('sha512', $salt + $pass);

$rowAgent = mysql_fetch_array(mysql_query('SELECT * FROM agents WHERE name ="' . strtolower($user) . '"'));

if ($rowAgent['password'] != $passToCheck) {
    header("location:mainLogin.php");
    exit;
}

header("location:selectamount_new.php");

The strange thing is that when I enter something with letters to the password input the system let my in (no matter what), and when I enter just numbers the system will check the password correctly and will not let me in (will redirect me to mainLogin.php and not to selectamount_new.php).

Again on my local machine it's works just fine, the problem is that when I push the code to Linux machine (AWS) with Git.

Are the character encodings the same, on your local machine and on the server? — fabpico
– fabpico, Commented Sep 7, 2015 at 7:03
The SHA-* family is not appropriate to hash passwords, because the algorithm is too fast. Have a look at the functions password_hash() and password_verify(). — martinstoeckli
– martinstoeckli, Commented Sep 7, 2015 at 7:42
@martinstoeckli thanks! but sadly I currently can't use them, I work on a system with PHP version 5.3. Fortunately It's temporary, we build a new back-end and the PHP version will be newer, so I'll use them in the future.. — nirgn
– nirgn, Commented Sep 7, 2015 at 8:02
@Nir - But you can, there is a compatibility pack for PHP 5.3.7 and later. As soon as you switch to a newer PHP version you can just remove the file from your project. — martinstoeckli
– martinstoeckli, Commented Sep 7, 2015 at 11:28

Cosmin · Accepted Answer · 2015-09-07 07:01:44Z

4

The problem is at $salt + $pass. This is not concatenation, is + operator, like in math. So string + string = nothing, that means every password will match. number + string = number, that is why with numbers this works. You should use here the . operator, that means the concatenation.

Anyway, if you don't proof against SQL injection, anyone will be able to login in your site, regardless of this fix.

answered Sep 7, 2015 at 7:01

Cosmin

1,49012 silver badges26 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

nirgn Over a year ago

Thanks, It worked! I'm new to PHP and didn't notice that.. \: And I'm taking care of the SQL Injection part, the system is not public yet..

SilverlightFox Over a year ago

@Nir: Also get rid of SHA-512 and use something secure like bcrypt, scrypt or pdkdf2.

Collectives™ on Stack Overflow

php password check with hash doesn't work

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related