how to retrieve MD5 password

Question

I've put username and md5(password) on my MySQL database. Below is my old login PHP code. I want to add some code that can retrieve my md5 password, because on my old code there is no md5 password. Where is should I add md5(password)?

Here is my full login code:

<?
if ($_POST['username']) {
$username=trim($_POST['username']);
$username = mysql_real_escape_string($username);
$password=trim($_POST['password']);
$password=mysql_real_escape_string($password);
//$password = hash('md5','$password');



if ($password==NULL) {
header("Location: login.php?error=2");
}else{

if($_POST['code']!=$_SESSION['string']){ 
header("Location: login.php?error=1");
}else{

$query = mysql_query("SELECT username,password FROM tb_users WHERE username = '$username'") or die(mysql_error());
if(mysql_num_rows($query) == 0)
{
header("Location: login.php?error=3");

} else {
$data = mysql_fetch_array($query);
if($data['password'] != $password) {
header("Location: login.php?error=4");
}else{

$query = mysql_query("SELECT username,password FROM tb_users WHERE username='$username'  ") or die(mysql_error());
$row = mysql_fetch_array($query);

$nicke=$row['username'];
$passe=$row['password'];

setcookie("usNick",$nicke,time()+36000);
setcookie("usPass",$passe,time()+36000);

$lastlogdate=time();
$lastip = getRealIP();

$querybt = "UPDATE tb_users SET lastlogdate='$lastlogdate', lastiplog='$lastip' WHERE username='$nicke'";
mysql_query($querybt) or die(mysql_error());

$query = mysql_query("SELECT akhirupgrade from tb_upgrade WHERE username = '$username' and status='upgraded'") or die(mysql_error());
if(mysql_num_rows($query) > 0) {
$row = mysql_fetch_array($query);
$akhir=$row["akhirupgrade"];
$tgl=time();
if ($tgl > $akhir) {
$query = mysql_query("update tb_upgrade set status='', date='', paket='', akhirupgrade='' WHERE username='$username' and status='upgraded'");
$query = mysql_query("update tb_users set account='' WHERE username='$username'");
}
}
header("Location: member.php");
}

}

}

}

}

?>

**Danger**: You are using [an unsuitable hashing algorithm](http://php.net/manual/en/faq.passwords.php) and need to [take better care](https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet) of your users' passwords. — Quentin, Jun 18 '17 at 19:42
**Warning**: You are using [an **obsolete** database API](http://stackoverflow.com/q/12859942/19068) which has been **removed** entirely from the latest version of PHP. You should use a [modern replacement](http://php.net/manual/en/mysqlinfo.api.choosing.php). — Quentin, Jun 18 '17 at 19:43
I don't think `retrieve my md5 password` is what you want. You are really asking how to compare the plain text password against the hashed DB version to authenticate, right? As already noted you shouldn't use md5 anymore. — chris85, Jun 18 '17 at 19:50
Use Sha256 when dealing with passwords. MD5 is unsecure and outdated. — , Jun 18 '17 at 19:56
can you give me a tutorial applying this sha256 to my code above, since i newbie here. — alexistdev, Jun 18 '17 at 20:01
@TyQ., no don't use SHA256. Use something specifically designed for passwords, like `password_hash()` and `password_verify()`. You shouldn't be dealing with hash details yourself. — ChrisGPT was on strike, Jun 18 '17 at 22:23
Most of the times you can just search the MD5 hash in Google and it'll find the original string. — Álvaro González, Jun 19 '17 at 10:41

Hadley8899 · Accepted Answer · 2017-06-20T17:36:24.117

I would use password_hash() if you running on php 5.5 or greater

When you send the password to the database simply hash it with the function

$password = password_hash(filter_input(INPUT_POST, "password"));

The when you pull the password back out of the database do the same thing to the password they submitted.

$passwordFromDb = $result['password']; //Password from the database
$passwordFromLoginForm = password_hash(filter_input(INPUT_POST, "password");

//Then when youve got the password to check it agaisnt there input

if($passwordFromDb === $passwordFromForm){
    //The password they entered was the same as the password in the database
} else {
    //The password was wrong
}

I have not tested this code so there may be errors but hopefully youll get the point :)

PS dont use MD5 please, Very insecure

If you must use md5

$password = md5(filter_input(INPUT_POST, "password"));//Store password


$passwordFromDb = $result['password']; //Password from the database
$passwordFromLoginForm = md5(filter_input(INPUT_POST, "password");

//Then when youve got the password to check it agaisnt there input

if($passwordFromDb === $passwordFromForm){
    //The password they entered was the same as the password in the database
} else {
    //The password was wrong
}

hello thanks for replying my thread, i've tried your given method, but there is a problem,that the password result is empty on database mysql. since my code is old one, if i still want use MD5 or sha1 , what is the right code? — alexistdev, Jun 18 '17 at 22:44
Have you checked in the database to see if the password went in ? To use MD5 $passwordFromForm = md5(filter_input(INPUT_POST, "password")); To put the password in the database then when you pull the hash back from the database you can compare with $passwordFromForm = md5(filter_input(INPUT_POST, "password")); $passwordFromDb = $result['password']; if($passwordFromForm === $passwordFromDb) { //Password was correct } else { //Password was wrong } Please bear in mind you cannot just copy and paste this and hope it works Ryan — Hadley8899, Jun 20 '17 at 17:30

how to retrieve MD5 password

1 Answers1