Databases
StackOverflow2013
Postsdbo
PONot able to verify hashed password
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PONot able to verify hashed password
    primarykey
    data
    text
    <p>I'm using SHA-512 to encrypt passwords. I think that I'm doing everything correctly (and even duplicating code that is successful elsewhere), but every time I try to enter a password, it fails to match what I have stored in my database.</p> <pre><code>$sql = "SELECT hashed_password FROM Users WHERE user_name='$username'"; $result = mysql_query($sql); $db_password = mysql_result($result, 0); if (crypt($currentPlaintext, $db_password) != $db_password) { echo "Your current password is incorrect."; die(); } </code></pre> <p>I have verified the following obvious potential problems and eliminated them as causes:</p> <p>1) There is an encrypted password stored in my database</p> <p>2) I am able to retrieve this password and store it in the variable $db_password</p> <p>3) The variables $username and $currentPlaintext do have the correct values as passed over by my ajax function call.</p> <p>So, why isn't this working? Am I missing something obvious? Thanks!</p> <p>EDIT: Thanks for the comments so far. To clarify, as I understand the crypt() function, the second argument of crypt is actually the entire string that is stored in the db. This string includes not only the hashed password, but also the algorithm, salt value, and number of rounds of hashing. The crypt() function is supposed to pull the salt value out of this string and then apply it to hash the first argument. The result is then compared to the previously hashed password. That's why this is so confusing. I don't have to give it a salt value - the salt is there in the database. Am I misunderstanding what is going on in this function?</p> <p>I originally hashed the password with this code:</p> <pre><code>$salt = uniqid(); $algo = '6'; $rounds = '5000'; $cryptSalt = '$' . $algo . '$rounds=' . $rounds . '$' . $salt; $hashedPassword = crypt($plaintext, $cryptSalt); </code></pre>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PTQuestion
    1. USKate
    1. USKate
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. PONot able to verify hashed password
      1. USJorge Bellido
      1. VTFavorite
    2. VO
      singulars
      1. PONot able to verify hashed password
      1. This table or related slice is empty.
      1. VTDownMod
    1. COMaybe that you're using the encrypted password from your DB as the salt? See [`crypt`](http://us1.php.net/manual/en/function.crypt.php)
      singulars
      1. PONot able to verify hashed password
      1. USJon
    2. COIt's best to use a trusted external source for one way encryption. One I have found useful: https://github.com/SlayerSolutions/Authentication/blob/master/Downloads/Version%202%20%28Class%29.php OR https://github.com/ircmaxell/PHP-PasswordLib
      singulars
      1. PONot able to verify hashed password
      1. USDaryl Gill
    3. COto give a meaningful answer you need to know how the hashed_password came into the db, how was it hashed? and do you know wether crypt() will actually hash the currentPlaintext password the same way you did for generating hashed_password in the first place? So, summing up, there is to little information about how you handle hashing to give a meaningful answer
      singulars
      1. PONot able to verify hashed password
      1. USNiko S P
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload