Comparing MD5 hashed passwords is not working

Question

So I just learned about storing passwords with MD5 hash and salt in PHP/MySQL. The method I'm using is md5(md5($row["id"].$password)), so the salt is an MD5 hash of the user's ID in my SQL table (which is an auto-incremented INT), which is concatenated to the inputted password string and then re-hashed.

The problem I'm encountering is that when I trying making a test account, and then logging in with the test account, the hash I generate on logging in isn't matching the hash I created when the account was created.

Login Code:

<?php

$login = mysqli_connect("hiding this info for obvious reasons");

if ($_POST["login"])
{

    $email = $_POST["email"];
    $password = $_POST["passsword"];

    $query = "SELECT * FROM useraccs WHERE email='$email'";

    if ($result = mysqli_fetch_array(mysqli_query($login,$query)))
    {
        $hashpass = md5(md5($result["id"]).$password);

        if ($hashpass == $result["password"])
        {

            $errors = "Logged in succesfully.";

        }

    }
    else
    {
        $error.= "E-mail/Password do not match anything in our database.";
    }

}

?>

Register Code:

<?php

$login = mysqli_connect("hiding this info for obvious reasons");

if ($_POST["submit"])
{

    $username = $_POST["username"];
    $email = $_POST["email"];

    $query = "INSERT INTO useraccs (username,email) values('$username','$email')";

    mysqli_query($login,$query);

    $query = "SELECT id FROM useraccs WHERE username='$username'";

    $userid = mysqli_fetch_array(mysqli_query($login,$query))["id"];

    $password = md5(md5($userid).$_POST["password"]);

    $query = "UPDATE useraccs SET password='$password' WHERE username='$username'";

    mysqli_query($login,$query);

}

?>

As you can see, the way I hash the password in both scenarios is identical, and I have done testing to confirm that I am getting the same value for the ID in both scenarios. I am truly stumped as to why I am not getting a match.

I'd like to mention I am very new to using MySQL/creating login systems, so if I've done anything blatantly wrong or have left out essential information, please let me know.

Danger: You are vulnerable to SQL injection attacks that you need to defend yourself from. — Quentin
Danger: You are using an unsuitable hashing algorithm and need to take better care of your users' passwords. — Quentin
If this is a live site or intended to go live, call it a blessing in disguise. — Funk Forty Niner

Zsolt Szilagyi Zsolt Szilagyi · Accepted Answer · 2016-03-06T01:43:36

First of all, please see the warnings in the comments, your code is highly unsure.

Regarding the md5: You are using

mysqli_fetch_array(mysqli_query($login,$query))["id"];

This will always return an array. Be sure to get only the field.

Comparing MD5 hashed passwords is not working

1 Answers