0

I've created a page called My Profile that displays all a user's information from the database when they log in. Problem is, I used md5 encryption on the password & now when I display it in a user's profile they see the encrypted password too. I want them to see their original password but nothing seems to be working. Here's my code for displaying the user's info:

<?php

$con = mysqli_connect("localhost","root","","tttwitch");
// Check connection
if (mysqli_connect_error())
{
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}

$sql = "SELECT * FROM users WHERE username='".$_SESSION['CurrentUser']."' ";
$mydata = mysqli_query($con, $sql);
echo "<table border=1>
<tr>
<th>Username</th>
<th>Password</th>
<th>Email</th>
<th>First Name</th>
<th>Last Name</th>
<th>Telephone</th>
<th>Address</th>
<th>Sex</th>
<th>Date of Birth</th>
</tr>";

while($record = mysqli_fetch_array($mydata)) {

echo "<tr>";
echo "<td>" . $record['username'] . "</td>";
echo "<td>" . $record['psw'] . "</td>";
echo "<td>" . $record['email'] . "</td>";
echo "<td>" . $record['fname'] . "</td>";
echo "<td>" . $record['lname'] . "</td>";
echo "<td>" . $record['telephone'] . "</td>";
echo "<td>" . $record['address'] . "</td>";
echo "<td>" . $record['sex'] . "</td>";
echo "<td>" . $record['dateofbirth'] . "</td>";
}
echo "</table>";

mysqli_close($con);
?>
Skitz
  • 25
  • 4
  • 1
    you can't reverse an md5 hash. – Squeegy May 18 '15 at 03:17
  • 1
    A couple of comments on this: First off, you're using unsalted MD5. It's not designed to be reversed but MD5 is [cryptographically weak](http://security.stackexchange.com/questions/19906/is-md5-considered-insecure) so anyone can brute force it. If you're going to hash passwords use something more secure like [password_hash](http://us.php.net/manual/en/function.password-hash.php). Second, generally speaking it's a bad idea to have reversible encryption for passwords because if you can reverse it, anyone who gets your private key can reverse it too – Machavity May 18 '15 at 03:19
  • i have never seen a website that would show me my password in plain text on screen, if i did i would delete my account and run screaming. –  May 18 '15 at 03:27

0 Answers0