[PHP] Sha1 encryption and salt

[becool007]

Okay so like you guys so my thread about my Parse errors, those were dumb errors. But i would like to clarify something. When i use sha1($pass) where variable $pass = $_POST['pass'] which gets from the form with the following data <input type="password" width="100" maxlength="20" name="pass" />.

Now when i execute the following query on php:

		$userq = mysql_query("SELECT * FROM `accounts` WHERE `name` = '".$user."' AND `password` = '".$passsha1."'") or die(mysql_error());
		$usernum = mysql_num_rows($userq);

Yes, i do enter the correct user name and password but $usernum returns the value of Zero. So i trouble shooted this by adding echo "$passsha1" and then compared to the one on MySQL. Indeed the encryptions were incorrect. That is my 1st thing.

Seconds is what the fk is "salt".


~becoool
Ty soo mch

 

[Guildjuhh]

sha is case-sensitive, And maybe you did something wrong and therefor you encrypted a space (happened to me that i sha-ed an non-exsisting post var for my password :') ).

Second, a salt is a string you encrypt together with the pass, so like this:

$salt = '894hjdklsa^7876342;';
$pass = sha1($salt . $_POST['something'] . $salt);

Or something like that, so that they cannot use a online database to check for the hash to exsist. And even the simplest passwords cannot be found anymore :')

 

[TheAJ]

im not very good in php but i'll give it a try:

$result = mysql_query("SELECT * FROM `accounts` WHERE `name` = '".$user."' LIMIT 1") or die(mysql_error());

if (mysql_num_rows($result) > 0)
{
	while($i = mysql_fetch_assoc($getnotes))
	{
		if (sha1($i['password']) == $passsha1)
		{
			echo "login successful";
		}
		else
		{
			echo "login failed";
		}
	}
}

 

[lordvladek]

<?PHP
function validateLogin($user, $pass) {
	$user = sha1(htmlspecialchars(stripslashes($user)));
	$pass = sha1(htmlspecialchars(stripslashes($pass)));
	
	$querySafe = sprintf("SELECT * FROM `accounts` WHERE `name`='%s' LIMIT 1",
							mysql_real_escape_string($user)) or die(mysql_error());
	$query = mysql_query($querySafe);
	if(mysql_num_rows($query) != 1) {
		return false;
	} else {
		while($var = mysql_fetch_array($query) or die(mysql_error())) {
			if($var['password'] != $pass) {
				return false;
			} else {
				return true;
			}
		}
	}
}
$var = validateLogin($_POST['username'], $_POST['pass']);
if($var != true) {
	echo "You have entered and invalid username or password.";
} else {
	echo "Logged in successfully";
}
?>

Its small, nothin big. Salt is when you generate random characters then mix them in with your hash to make the format the password is stored in harder to break. And example would be:

<?PHP
$salt = rand(32767,65535);
$Username = "I'mSexy";
$saltTest = sha1($Username.$salt);
echo $saltTest." - Username salted<br />";
echo $salt." - This is your salt.<br />";
//Lets try and see if we can grab the username without the salt
if(sha1($Username) == $saltTest) {
	echo "It worked without the salt<br />";
} else if(sha1($Username.$salt) == $saltTest) {
	echo "Obviously it didnt work without the salt<br />";
}
?>

The main thing with salt is if your going to use it, you have to store it in the database because PHP alone cant just decode it and find the random salt values you entered into it. So if your goin to use it always store it in your database somewhere with the username.