Databases
StackOverflow2013
Postsdbo
POSalting in PHP and MySQL
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POSalting in PHP and MySQL
    primarykey
    data
    text
    <p>I have been developing a login library for a website using CodeIgniter. The authentication code is as follows:</p> <pre><code>function signin($username, $password) { $CI =&amp; get_instance(); $query_auth=$this-&gt;db-&gt;query('SELECT user_id, banned FROM user WHERE username=? AND password=SHA1(CONCAT(?,salt)) LIMIT 1', array($username, $password)); if($query_auth-&gt;num_rows()!=1) return 2; else { if($query_init-&gt;row()-&gt;banned==1) return 3; else { $CI-&gt;load-&gt;library('session'); $this-&gt;session-&gt;set_userdata('gauid', $query_auth-&gt;row()-&gt;user_id); return 1; } } } </code></pre> <p>The return values signifying success, failure or banned. Each user has a unique salt stored in the database.</p> <p>Originally i grabbed the salt from the database, combined the users inputted password and salt from the database in PHP, then queried the database again with the combined value. I thought that this would speed things up as only one trip to the database is required and there is less code. I also thought that it would be equally secure, however after reading the top reponse to this question <a href="https://stackoverflow.com/questions/3273293/salting-my-hashes-with-php-and-mysql">Salting my hashes with PHP and MySQL</a> ...</p> <blockquote> <p>First of all, your DBMS (MySQL) does not need to have any support for cryptographic hashes. You can do all of that on the PHP side, and that's also what you should do.</p> </blockquote> <p>...I started to wonder if there was a security problem i had neglected to spot.</p> <p>Is there actually anything wrong this code?</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USCommunity
    1. USj82374823749
    plurals
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POSalting in PHP and MySQL
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POSalting in PHP and MySQL
      1. This table or related slice is empty.
      1. VTDownMod
    1. COpossible duplicate of [Secure hash and salt for PHP passwords](http://stackoverflow.com/questions/401656/secure-hash-and-salt-for-php-passwords)
      singulars
      1. POSalting in PHP and MySQL
      1. USrook
    2. COI don't see how that's true! The questions are completely different.
      singulars
      1. POSalting in PHP and MySQL
      1. USj82374823749
    3. COThen it should be closed for being too localized.
      singulars
      1. POSalting in PHP and MySQL
      1. USrook
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload