problem with passwords using sha256

Question

I am playing around with password encryptions and i am having some trouble when I write the password into database and when I ry to log in to the page.

When I insert the password:

$pword = "huuhaa";
$uname = "huuhaa";

$pword = hash('sha256' ,'$pword');
    $insuser="INSERT INTO words(username,password) VALUES('$uname','$pword') ";

$insresult=mysql_query($insuser);

In the log in:

$myusername= 'huuhaa';

$mypassword = 'huuhaa';


$mypasswordCRYPTED = hash('sha256' ,'$mypassword');


$sql="SELECT userid FROM words WHERE username='$myusername' and password='$mypasswordCRYPTED'";

LOG IN:

the value in database is different from the value in login eg. $pword in database: e5f252f... And in log in: $mypasswordCRYPTED = as89dw....

Would someone please explain this to me?

Thank you

Jon Skeet · Accepted Answer · 2011-08-25 09:02:12Z

4

Don't you want:

$pword = hash('sha256', $pword);

and

$mypasswordCRYPTED = hash('sha256', $mypassword);

i.e. the variable rather than the string '$pword'? It would have worked with "$pword" using double quotes to get PHP to perform string interpolation, but it's a lot clearer just to use the variable itself as the function argument.

So basically you were comparing the hashes of the string '$pword' and '$mypassword' - which unsurprisingly aren't the same :)

answered Aug 25, 2011 at 9:02

Jon Skeet

1.5m893 gold badges9.3k silver badges9.3k bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

genesis Over a year ago

Damn jon, you're 2 seconds faster :( Good job

Phil Over a year ago

PHP interpolates in double-quoted strings, not single-quoted ones. That string is literally "$pword"

Jon Skeet Over a year ago

@Phil: Thanks. Will update. (It's obviously clearer not to bother with interpolation anyway.)

Phil Over a year ago

@genesis Jon actually answered 2 seconds after the question was posted. He was just holding off for suspense ;-)

genesis Over a year ago

@Phil: No. That's lie. He answered it 2 seconds BEFORE question was posted. But this answer just shows the turth of this post :( ;)

genesis · Accepted Answer · 2011-08-25 09:02:15Z

1

change

$pword = hash('sha256' ,'$pword');

to

$pword = hash('sha256' ,$pword);

because that first one recognizes your password as $pword

and the same thing with second variable

$mypasswordCRYPTED = hash('sha256' ,'$mypassword');

to

$mypasswordCRYPTED = hash('sha256' ,$mypassword);

answered Aug 25, 2011 at 9:02

genesis

51.1k20 gold badges99 silver badges127 bronze badges

Comments

gnur · Accepted Answer · 2011-08-25 09:02:40Z

0

You are hashing the string '$mypassword', try changing it to $mypassword and changing '$pword' to $pword.

answered Aug 25, 2011 at 9:02

gnur

4,7412 gold badges22 silver badges33 bronze badges

Collectives™ on Stack Overflow

problem with passwords using sha256

3 Answers 3

5 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

5 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related