Home/ Questions/Q 6817547
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-26T21:04:08+00:00

I have a form for updating user data. It posts to this page: <?php

  • 0

I have a form for updating user data. It posts to this page:

<?php
    //Update user table
    session_start();
    include 'sql_connect_R.inc.php';

    $id = mysql_real_escape_string($_POST['userID']);
    $password = mysql_real_escape_string($_POST['user_passwrd']);

    $salt = time();
    $hash = sha1($password . $salt);

    mysql_query("UPDATE users SET user_passwrd = '$hash', stamp = '$salt', pending = 'yes'
    WHERE userID = '$id'");

    mysql_close($con);
?>

(I have edited out the things not pertinent to this question)

I believe what is happening is when the ‘stamp’ field is being populated with the $salt it is getting a different value than when the $hash is being calculated. Therefore, when a user signs in and is checked here:

$qry="SELECT * FROM users WHERE userlogin = '$login' AND user_passwrd = sha1(CONCAT('$password', stamp))";
    $result=mysql_query($qry);
    $row = mysql_fetch_assoc($result);
    $num = mysql_num_rows($result);

When I echo $num it returns a value of 0.
I’m wondering if there is a way to ensure that the value of $salt remains the same when it is being used in $hash and then when it is updating the field ‘stamp’.
Can anyone help me with this or point me in the right direction? Thanks in advance.
Cheers

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Thank you for all comments. I want to report that I’ve ‘solved’ the problem. I had made a change in the name of the password input field late one night and neglected to change the $_POST value. What this did, of course, was not supply the $password value to the $hash. Though I’m embarrassed about this, I think it is important for me to share my oversight to exemplify how important it is to check ALL places where errors can occur. I failed to double-check everything and made incorrect assumptions about the nature of the problem. The code worked fine, it was the loose screw in front of the keyboard that caused the problems. Cheers

    • 0