Question

Here is my failing code. I’m stil getting familiar with syntax so I’m guessing that might be an issue. crypt took a while for me to understand, but it basically generates a seemingly random salt and stores it in the “encrypted” password. So when you want to test against it, you need to retrieve the salt from the stored password. Hence the sign_in code is longer.

The insert upon sign_up

  $pass = crypt($pass);
  database::query("INSERT INTO cr VALUES ('$fname', '$lname', '$email', '$pass')");

The check upon sig_in

$query = "SELECT pass FROM cr WHERE email='$email'";
$row = mysql_fetch_row(database::query($query));
$pass = crypt($pass, $row[0]);
$query = "SELECT email,pass FROM cr WHERE email='$email' AND pass='$pass'";
if (mysql_num_rows(database::query($query)) == 0)
  {

Answer 1

Here’s a bcrypt helper class you can use.

Usage:

$bcrypt = new bcrypt(7); // number of rounds
$hash = $bcrypt->hash('password');
$isGood = $bcrypt->verify('password', $hash);
echo "$hash $isGood"

PS – Your code is vulnerable to SQL injection. Consider looking into prepared statements. Check out PDO and MySQLi.

edit – I forgot to take out a couple of undefined constants from the class, so feel free to kill BCRYPT_ROUNDS and any others you might find. Apologies.