0

On php. How we use md5 encryption method? Suppose a login form. When we want an encrypted text we use

$encryptedtxt=md5('text');

Then we sent this $encryptedtxt to database. Now if we want this $encryptedtxt to compare with user new inputs to login , what should we do? If we should return text from encrypted form of it, how? Tnx.

Artjom B.
  • 61,146
  • 24
  • 125
  • 222
Soroosh Noorzad
  • 503
  • 1
  • 6
  • 18
  • 3
    *"what should we do?"* - If this is for passwords, the answer is simple; **don't use it**. It's 30 years old and not safe to use anymore. Plus, "how-to's" can be found on the Web. Show us what you tried. – Funk Forty Niner May 24 '15 at 22:17
  • Tnx! @Fred-ii- is there any other way to secure the password more than normal? – Soroosh Noorzad May 24 '15 at 22:19
  • 3
    For password storage, use [**CRYPT_BLOWFISH**](http://security.stackexchange.com/q/36471) or PHP 5.5's [`password_hash()`](http://www.php.net/manual/en/function.password-hash.php) function. For PHP < 5.5 use the [`password_hash() compatibility pack`](https://github.com/ircmaxell/password_compat). – Funk Forty Niner May 24 '15 at 22:19
  • @Fred-ii- one another question , why this is not a deprecated function, when you say that is not so safe? if there is better way , why this is still use by people? tnx for your attention. – Soroosh Noorzad May 24 '15 at 22:24
  • 1
    I posted an answer for you below, which uses safe methods, in both passwords and MySQL. There are a few links you can read up on why MD5 isn't safe anymore. – Funk Forty Niner May 24 '15 at 22:27
  • 2
    @Sonoo - It isn't deprecated because md5 has perfectly valid uses still, it's just not good for password hashing – Mark Baker May 24 '15 at 22:29
  • @MarkBaker I agree with you on that aspect Mark. ^ – Funk Forty Niner May 24 '15 at 22:29

1 Answers1

3

MD5 is no longer considered safe to use for password hashing, it's 30 years old and is considered "broken".

Use a modern-day method, including prepared statements.

Here are a few articles you can read up on:

Pulled from ircmaxell's answer https://stackoverflow.com/a/29778421/

Just use a library. Seriously. They exist for a reason.

Don't do it yourself. If you're creating your own salt, YOU'RE DOING IT WRONG. You should be using a library that handles that for you.

$dbh = new PDO(...);

$username = $_POST["username"];
$email = $_POST["email"];
$password = $_POST["password"];
$hash = password_hash($password, PASSWORD_DEFAULT);

$stmt = $dbh->prepare("insert into users set username=?, email=?, password=?");
$stmt->execute([$username, $email, $hash]);

And on login:

$sql = "SELECT * FROM users WHERE username = ?";
$stmt = $dbh->prepare($sql);
$result = $stmt->execute([$_POST['username']]);
$users = $result->fetchAll();
if (isset($users[0]) {
    if (password_verify($_POST['password'], $users[0]->password) {
        // valid login
    } else {
        // invalid password
    }
} else {
    // invalid username
}
Community
  • 1
  • 1
Funk Forty Niner
  • 74,450
  • 15
  • 68
  • 141