Question

I am trying to match a md5 has (generated through php) to its original value in a SQLExpress database.

I am using the following function in my SQL query

master.sys.fn_varbintohexsubstring(0, HASHBYTES('MD5', 'ID'), 1, 0)

Where ‘ID’ is the field in the database.

However they both seem to return different values for the md5 hash. I have been using ‘12290’ as a static value to test this.

php md5() returns: 0bd81786a8ec6ae9b22cbb3cb4d88179

The following SQL Statement returns the same output:

DECLARE @password VARCHAR(255)
SET @password = master.sys.fn_varbintohexsubstring(0, HASHBYTES('MD5', '12290'), 1, 0)
SELECT @password

Yet when I run the following statement from the table:

SELECT ID,  master.sys.fn_varbintohexsubstring(0, HASHBYTES('MD5', CONVERT(NVARCHAR(255), ID)), 1, 0) AS temp
FROM Clients
ORDER BY ID ASC

The ‘temp’ value matching to the ‘ID’ value of 12290 returns: 1867dce5f1ee1ddb46ff0ccd1fc58e03

Any help on the matter would be much appreciated!

Thanks

Answer 1

I don’t have SQL server to test this on, but the CONVERT command might be creating the NVARCHAR with 240-odd trailing blanks (as you have specified NVARCHAR(255))

Try setting the NVARCHAR to the length of the ID to test:

ARE @password VARCHAR(255)
SET @password = master.sys.fn_varbintohexsubstring(0, HASHBYTES('MD5', CONVERT(NVARCHAR(5), '12290')), 1, 0)
SELECT @password

Try with different lengths in the CONVERT – is there any difference?