php md5 password for user login

Question

I seem to have tried every way to get my log in working however when i attempt to log in it stops at the users password and never fetches it.I am using sha1 in my register and that works fine when inserting into the database.

$username = $_POST['username'];
$password = md5($_POST['password']);

$result = mysql_query("SELECT * FROM users WHERE username = '$username' ");



while ($row = mysql_fetch_array($result))
{
    if($username == $row['username'] )
    {
        if( $password == $row['password'])
        {
            header("location: profile.php");
        }
        else    
            echo 'pass problem';
    }
    else

        echo 'username issue ';


}

Answer 1

So many issues...

1. md5 is not secure. Use a salt + key + password.
2. mysql_ functions are deprecated. Use mysqli_ or PDO
3. No sanitation. Use prepared statements and bound parameters.
4. Don't SELECT *. Get only the columns you need.
5. Add a LIMIT for how many results you want to return
6. No need for a while loop for a single result.
7. How is the password being stored in the database? Obviously an md5'd password isn't matching to your column.

The actual problem

You can't mix encryption types if the user's password is stored as sha1 and then compared to md5.

Answer 2

I recommend using the PHPass library to secure your passwords, since md5 and shai and other encryption algorithms are NOT safe.

PHPass takes care of

1. Encrypting.
2. Salting.
3. Stretching.

And that method has not yet been cracked (brute forcing can not be considered as an crack for PHPass).

You can get it from here: http://www.openwall.com/phpass/

IT's very easy to hash once you've set up the code:

$hash = PasswordHash($iteration_count_log2, $portable_hashes)

And then you can fetch the stored hash from the database, and match the login-password-hash with the existing hash via the function

$auth = CheckPassword($incomingPasswordNotHashed, $hashFromDatabase);

I like to make it simpler by doing something like this to make an hash:

// Usage:   $hash = PHPhass($password);
// Pre:     $password is of type string,
//          indicating the password which
//          the user want's to hash.
// Post:    $hash is the hashed password.
function PHPhass($password)
{
    $unHashed = $password;
    require '../phpass/PasswordHash.php';
    header('Content-type: text/plain');
    $t_hasher = new PasswordHash(12, FALSE); // Define the iterations once.
    $hash = $t_hasher->HashPassword($unHashed);
    unset($t_hasher);
    return $hash;
}

And doing this to match a hash and a non-hashed password:

// Usage:   $check = PHPhassMatch($password, $hash)
// Pre:     $password is of type string,
//          indicating a user's passwordd
//          $hash is a hashed password.
// Post:    $check is true if $password's hash
//          value is equal to $hash.
function PHPhassMatch($password, $hash)
{
    $unHashed = $password;
    $theHashed = $hash;
    require '../phpass/PasswordHash.php';
    header('Content-type: text/plain');
    $t_hasher = new PasswordHash(8, FALSE);
    $check = $t_hasher->CheckPassword($unHashed, $theHashed);
    unset($t_hasher);
    return $check;
}

Also, like Fresh mentioned:

• Don't use the mysql_* since It's deprecated, I recommend using PDO or mysqli.
• Use prepared statements to prevent sql injection.
• Don't assume that the posted variables are posted, check if they exist with isset()

You mentioned shai1, are you sure that the passwords in the database are not sha1 but you're matching against md5?

Answer 3

If you insert new passwords using sha1, you have to use sha1 on password compare, too. If you compare a md5 string to a sha1 string it doesn't work. So you have to do this:

$password = sha1($_POST['password']);