All geek questions in one place

How to log in after hashing salt? <== UNITED VERSION # 2 ==>

This is my second change. I have been banging my head on the wall for several days now and feel that I am very close. I tried many different versions of this third piece of code and just can't get it. Any idea on what I am doing wrong (her third piece of code that has been modified)

if(!$error) {
    $alpha = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcedfghijklmnopqrstuvwxyz1234567890";
    $rand = str_shuffle($alpha);
    $salt = substr($rand,0,40);
    $hashed_password = sha1($salt . $_POST['Password']);
    $query = "INSERT INTO `Users` (
                `FirstName`,
                `LastName`,
                `Email`,
                `Password`,
                `salt`,
                `RelationshipToCF`,
                `State`,
                `Gender`,
                `Birthday`,
                `Status`
        )VALUES(
                '" . mysql_real_escape_string($_POST['firstName']) . "',
                '" . mysql_real_escape_string($_POST['lastName']) . "',
                '" . mysql_real_escape_string($_POST['email']) . "',
                '" . $hashed_password . "',
                '" . $salt . "',
                '" . mysql_real_escape_string($_POST['RelationToCF']) . "',
                '" . mysql_real_escape_string($_POST['State']) . "',
                '" . mysql_real_escape_string($_POST['sex']) . "',
                '" . mysql_real_escape_string($_POST['DateOfBirth_Year'] . "-" . $_POST['DateOfBirth_Month'] . "-" . $_POST['DateOfBirth_Day']) . "',
                'pending'
    )";
    mysql_query($query, $connection);

Here is the method I use to update existing passwords:

$query = "SELECT * FROM `Users`";
$request = mysql_query($query,$connection);
while($result = mysql_fetch_array($request)) {
    $alpha = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcedfghijklmnopqrstuvwxyz1234567890";
    $rand = str_shuffle($alpha);
    $salt = substr($rand,0,40);
    $hashed_password = sha1($salt . $result['Password']);
    $user = $result['id'];

    $query2 = "UPDATE `Users` SET `salt` = '$salt' WHERE `id` = '$user'";
    $request2 = mysql_query($query2,$connection) or die(mysql_error());
    $query3 = "UPDATE `Users` SET `encrypted_passwords` = '$hashed_password' WHERE `id` = '$user'";
    $request3 = mysql_query($query3,$connection) or die(mysql_error());
}

So now I want to allow the user to log in with the password that they signed up with, and at this point they can only log in with the hashed password. Obviously, this is not yet applicable to a real database.

Here is the query on the sign on the pages that I need to change:

    if(isset($_POST['subSignIn']) &&
       !empty($_POST['email']) &&
       !empty($_POST['password'])) {

        $email = mysql_real_escape_string($_POST['email']);
        $password = mysql_real_escape_string($_POST['password']);
        $query = "SELECT
             `id`,`email`,`password` FROM `Users`
             WHERE `Email` = '" . $email . "' AND
             `Password` = '" . $password . "'  &&
             `Status` = 'active' LIMIT 1";
        $request = mysql_query($query,$connection) or die(mysql_error());

        if(@mysql_num_rows($request)) {

            $result = mysql_fetch_array($request);
            $_SESSION['LIFE']['AUTH'] = true;       
            $_SESSION['LIFE']['ID'] = $result['id'];

$query = "UPDATE `Users` SET` LastActivity` = '" . date("Y-m-d") ." " . date("g:i:s") . "'   WHERE `id` ='" .mysql_real_escape_string($_SESSION['LIFE']['ID']) . "' LIMIT 1";

            mysql_query($query,$connection);

            if(!empty($_POST['return'])) {          
                header("Location: " . $_POST['return']);        
            }else{
                header("Location: Dashboard.php?id=" . $_SESSION['LIFE']['ID']);
            }
        }else{
            $_SESSION['LIFE']['AUTH'] = false;      
            $_SESSION['LIFE']['ID'] = false;    
        }

webernet , , /// .

< == == 5 == >

 i

f(isset($_POST['subSignIn']) && !empty($_POST['email']) && !empty($_POST['password'])) {


    $query = "SELECT id FROM cysticUsers WHERE Email = '$email' AND Password = SHA1(CONCAT(salt,'$password')) AND Status = 'active' LIMIT 1";
    $request = mysql_query($query,$connection) or die(mysql_error());

if(@mysql_num_rows($request)) {

        $row = mysql_fetch_assoc($request);
        if (sha1($row['salt'] . $_POST['password']) === $row['password']) {


        $_SESSION['CLIFE']['AUTH'] = true;
        $_SESSION['CLIFE']['ID'] = $result['id'];

        // UPDATE LAST ACTIVITY FOR USER
        $query = "UPDATE `cysticUsers` SET `LastActivity` = '" . date("Y-m-d") . " " . date("g:i:s") . "' WHERE `id` = '" . mysql_real_escape_string($_SESSION['CLIFE']['ID']) . "' LIMIT 1";
        mysql_query($query,$connection);

        if(!empty($_POST['return'])) {
            header("Location: " . $_POST['return']);

        }else{
            header("Location: CysticLife-Dashboard.php?id=" . $_SESSION['CLIFE']['ID']);
            }
        }

    }else{

        $_SESSION['CLIFE']['AUTH'] = false;
        $_SESSION['CLIFE']['ID'] = false;

    }
}

?>
+3
5

, , .

:

$hashed_password = sha1($salt . $result['Password']);

:

$hashed_password = sha1($salt . $_POST['Password']);

, , !

+1

, , / :

$user         // User has a $password and a $salt. $password = hash($plaintext . $salt);
$password     // Password we are checking.
return $user->password == hash($password . $user->salt);
+3

, , : .

, , , . , :

$query = "SELECT `salt`, `password` FROM `Users` WHERE `Email` = '" . $email . "'";
$request = mysql_query($query,$connection) or die(mysql_error());
if (mysql_num_rows($request)) {
    $row = mysql_fetch_assoc($request);
    if (sha1($row['salt'] . $_POST['Password']) === $row['password']) {
        // user authentic
    } else {
        // user not authentic
    }
}

, , , 1 .

1) , , , , collision, .

+3

?

-
  • , + .
  • , , , .
  • , ( ), .
  • .

.

:

$hashed_password = sha1($salt . $result['Password']);

$hashed_password, $salt .

When they log in, the password that you compared with the above $hashed_passwordwill look something like this:

$password = sha1($row['salt'] . $_POST['password']);

Make sense?

+1
source

First you need to take the salt key from the database by searching for the username you entered, and then you will enter the password you entered with the salt that you grabbed from the database and make sure that it matches the password for the username in the database. It will look something like this:

$query = "SELECT salt FROM Users WHERE username='$user'";
$result = mysql_query($query) or die ("AAAAGH!  *Thud*");
$row = mysql_fetch_assoc($result);
$salty_password = sha1($row['salt'], $_POST['password']);
$query = "SELECT * FROM users WHERE username='$user' AND password='$salty_password'";
$result = mysql_query($query) or die ("AAAAGH!  *Thud*");
if (mysql_num_rows($result)) {
    echo "Successfully authenticated!";
}
else {
    echo "Failed to Authenticate.";
}
+1
source

Source: https://habr.com/ru/post/1787501/

More articles:


All Articles