Question

I have a situation with my login page, for some strange reason it just does not allow the user to log in, even though I write in the correct username and password in the text fields. It keeps displaying the message that username or password is incorrect. Does anyone know why it is doing this?

Lets say the user’s details are this:

Username: j.lu
Password cricket

In the database it stores these details like this:

Username      Password

j.lu          21dfc92f24a130b9259aa650378a3170

It stores the password like this in the database because I am including salt.

But does anyone see if I have done something wrong in the login page because it does not login a user at all?

Answer 1

You need to store the salts generated when the user is registered, so you can determine the correct hash when the user tries to log in.

The purpose of the salt is to render rainbow tables ineffective. They don’t need to be secret (any more secret than the password hash, at any rate), so store it in the same table.