Need help... how to add md5 to password field in php?

Question

i looking some help and nice attention here..

i bought some php script many years ago and now no suport anymore... i just want to add md5 to password field..

here my form:

<?php
$SQL = "SELECT * from USERS WHERE USERNAME = '$_SESSION[username]'"; $result = @mysql_query( $SQL ); $row = @mysql_fetch_array( $result );

include 'menu.php';
?>
<FORM METHOD="post" ACTION="?page=query_client">
 <INPUT TYPE="hidden" NAME="controller" VALUE="USERS~update~account_details&up=1~<?php echo $row[ID]; ?>">

 <TABLE CLASS="basictable">
  <TR> 
   <TD CLASS="tdmenu"  WIDTH="40%">Username</TD>
   <TD CLASS="tdmenu"  WIDTH="60%"> 
    <b><?php echo $row[USERNAME]; ?></b>
   </TD>
  </TR>
  <TR> 
   <TD CLASS="tdmenu"  WIDTH="40%">Password *</TD>
   <TD CLASS="tdmenu"  WIDTH="60%"> 
    <INPUT TYPE="PASSWORD" NAME="PASSWORD" SIZE="40" VALUE="<?php echo $row[PASSWORD]; ?>">
   </TD>
  </TR>
  <TR> 
   <TD CLASS="tdmenu"  WIDTH="40%">Email Address *</TD>
   <TD CLASS="tdmenu"  WIDTH="60%"> 
    <INPUT TYPE="text" NAME="EMAIL" SIZE="40" VALUE="<?php echo $row[EMAIL]; ?>">
   </TD>
  </TR>
  <TR> 
   <TD CLASS="tdmenu"  WIDTH="40%">Full Name *</TD>
   <TD CLASS="tdmenu"  WIDTH="60%"> 
    <INPUT TYPE="text" NAME="FULLNAME" SIZE="40" VALUE="<?php echo $row[FULLNAME]; ?>">
   </TD>

  <TR> 
   <TD CLASS="tdmenu"  WIDTH="40%">Address *</TD>
   <TD CLASS="tdmenu"  WIDTH="60%"> 
    <INPUT TYPE="text" NAME="ADDRESS1" SIZE="40" VALUE="<?php echo $row[ADDRESS1]; ?>">
   </TD>
  </TR>

 <BR>
 <TABLE CLASS="basictable">
  <TR> 
   <TD CLASS="tdhead2" > 
    <DIV ALIGN="CENTER"><B> 
     <INPUT TYPE="submit" NAME="Submit" VALUE="Submit">
     </B></DIV>
   </TD>
  </TR>
 </TABLE>
</FORM>

and the

it self as query_client.php inside look like:

<?PHP
@session_start();

$controller = $_POST['controller'];
$pieces = explode("~", $controller);
$table = $pieces[0];
$qt =  $pieces[1];
$return =  $pieces[2];
$id =  $pieces[3];
$hack =  $pieces[4];

if ($qt == insert) $qt = 'INSERT INTO';
if ($qt == update) { $qt = 'UPDATE'; $end = "WHERE ID = '$id'"; }
$pre = array_keys( $_POST );

mysql_query ("CREATE TABLE IF NOT EXISTS `$table` (`ID` INT NOT NULL AUTO_INCREMENT , PRIMARY KEY ( `id` ) )");

$count = count($pre); $count = $count - 2;
$sql = "$qt $table SET";
for ($i=0; $i < $count; $i++)
{
$x=$i+1;
$y = $_POST[$pre[$x]];
$d = $y;
mysql_query ("ALTER TABLE `$table` ADD `$pre[$x]` TEXT NOT NULL");
$sql .= " `$pre[$x]` = '$d',";
}
$sql .= " ID = '$id' $end";
$query = mysql_query($sql) or die("$sql_error" . mysql_error());

if (empty($hack)) { } else {
$pieces = explode("/", $hack);
$h0 = $pieces[0];
$h1 = $pieces[1];
$h2 = $pieces[2];
$h3 = $pieces[3];
$h4 = $pieces[4];
$h5 = $pieces[5];

mysql_query ("ALTER TABLE `$table` $h0 $h1 $h2 $h3 $h4 $h5");
$query = mysql_query($sql) or die("$sql_error" . mysql_error());
}

if (isset($_GET[inc])) include "$_GET[inc].php";

?>

so please help me how to add md5 in PASSWORD field? thanks in advance..

do you understand that you will have to add an md5 to the password checking too? Anyway it won't help you with such `include "$_GET[inc].php";` a vulnerable code... the more i look into this code the more I getting scared — Your Common Sense, May 06 '10 at 06:30
OK Col. Shrapnel, i appreciated your nice comments but i am blind to php, and let me know to solve this...? from vulnerable code and also add md5 to password field? — jones, May 06 '10 at 06:42
OMG, not ony the $_GET[inc].php is a disaster, basically anyone can alter your table structures as they see fit by crafting a simple URL and throwing it at your query_client.php... So just throw it away and start from scratch. — wimvds, May 06 '10 at 07:42
for the record, stackoverflow is for _programmers_, we're not here to work for you for free — hobodave, May 06 '10 at 08:24
@ Col. Shrapnel OK how to start your idea...? @ wimvds i.m sorry i don't understand this, but how to alter the structure...? and how to solve this. thank you @ hobodave i bought this codes many years ago, and now not supports anymore, i just looking some nice suggestion.... could you? — jones, May 07 '10 at 02:33

score 2 · Answer 1 · edited May 23 '17 at 10:32

2

Best to use a salt also - hashing and verification should be done at server - see secure hash and salt for PHP

Some links on writing secure code:

edited May 23 '17 at 10:32

Community

1
1

answered May 06 '10 at 06:31

bignum

3,448
3
21
18

ok just please help me how to do this, any sample related to my script above.? – jones May 06 '10 at 07:04
1

@jones: I think the prudent thing to do would be to follow the advice of comments to your post i.e., rewrite it securely. I've added some additional links that may be of use in doing this. – bignum May 06 '10 at 08:36

Need help... how to add md5 to password field in php?

1 Answers1

Linked

Related