Question

Consider this:

$email = 'c5dfd29d956b52c1ffa00ce4a06abad2'; // From the query string (MD5)

$result = mysql_query('SELECT * FROM ' . $table
          . ' WHERE MD5(email_address) = ' . $email);

$row = mysql_fetch_array($result);
echo $row['email_address'];

I want to get the value from the ’email_column’ if the hashed emails are the same (From the database and from the query string using MD5). What is the correct way of doing this?

Answer 1

First of all, you forgot to add quotes around $email in your query. Also, if you’re taking it from the user, never ever forget to do mysql_real_escape_string before passing it to the DB.

Also, since MySQL does not allow function indexes, you must understand that this query will require MySQL to read every row of the table and run MD5 on every email to check. You should rather store the hash in a separate field and have an index on it.