Using MD5 on login page

Question

<?php

include("connect.php");
session_start();
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    // Username and password sent from form in HTML
    $myusername = $_POST['username'];
    $mypassword = $_POST['password'];

    $sql    = "SELECT id FROM users WHERE username='$myusername' and password='$mypassword'";
    $result = mysql_query($sql);
    $row    = mysql_fetch_array($result);
    $active = $row['active'];
    $count  = mysql_num_rows($result);

    // If result matched $myusername and $mypassword, table row must be 1 row
    if ($count == 1) {
        session_register("myusername");
        $_SESSION['login_user'] = $myusername;

        header("location: welcome.php");
    } else {
        $error = "Your username or password is invalid";
    }
}

?>

This is my current login code. On my registration page, I have it so that when it injects into the database, it injects the passwords already encrypted in MD5. However, I cannot seem to convert:

$mypassword=$_POST['password'];

Into MD5 to confirm to see if the password exists in the database. With this code, the passwords must not be encrypted. What should I change to make it so that it checks with the database encrypted?

Answer 1

Simply wrap $_POST['password'] into md5() like so:

$mypassword = md5 ($_POST['password']);

Needless to say, you have a number of other problems, like feeding the database an unescaped username, and hashing passwords without a salt, not to mention using md5() in the first place; use the built-in crypt(), pbkdf2, bcrypt or scrypt function for that, or any other key derivation function, preferably one that uses an up to date hash method and a large count (number of iterations). PHP 5.5 also introduced a simplified pasword hashing API, which you can look into here. For even more PHP hashing-related tips, see here.

Overall, as a developer, you can not live without giving this fascinating post a thorough read. Skip to the tl;dr at the bottom if you can't be bothered (and are okay with killing kittens).

Answer 2

PHP recommends you not use MD5 to hash passwords: http://www.php.net/manual/en/faq.passwords.php#faq.passwords.fasthash

To answer your question directly, however, you can md5 a string using md5(). Example:

$mypassword = md5($_POST['password']);

And you can compare it later using the same thing:

"SELECT... WHERE password = '".md5(mysqli_real_escape_string($someValue))."'"

Answer 3

As far as i understand the question. If you are storing password md5 encrypted in db you just need to compare like this $myPassword = md5($_POST['password'])

Answer 4

Traditionally you can put it like this:

$myPassword = md5(mysqli_real_escape_string($_POST['password']));

But since there are proven vulnerabilities in MD5 hash, you can use other hash algorithm in here. Ideally, you can use SHA-512 like this:

$myPassword = hash('sha512',mysqli_real_escape_string($_POST['password']));

Take note that mysqli_real_escape_string is also important in making such queries to prevent sql injections then you can simply compare the hashed password when logging in.

Answer 5

First wrap your variable into md5 function like this

$myPassword = md5($_POST['password']);

how are you using just $myusername it must me some associative array because you are accessing a table ex(you also have to select *all not just id from db):-*

$_SESSION['login_user'] = $row['username'];

then change this

if ($_SERVER["REQUEST_METHOD"] == "POST")

to this:-

if (isset($_POST["submit"]))

Answer 6

Thanks for the help everyone! Okay so I was really stupid... put a limit in the database for the encrypted password. Also, thanks for the recommendations on how to hash my passwords and stuff.