Question

I use the following code…

      $mail = new PHPMailer();  
      $mail->IsSMTP(); // send via SMTP
      $mail->SMTPAuth = true; // turn on SMTP authentication
      $mail->Username = $USR_EMAIL; // SMTP username
      $mail->Password = $MAIL_PWD; // SMTP password

I would like to ask some simple questions..
Is there a way to pass to phpMailer a password saved in md5 format in the database?
Is there any other type of hashing that phpMailer supports?
Is there a sending email php script that supports hashed passwords?
I am terrified in the idea that i will have an email password stored anywhere without some kind of encryption..

Answer 1

You have to send plain password to SMTP. Hash functions are one-way, they just “obfuscates” the input, so SMTP can not authenticate you with it.

You could encrypt the password, probably AES, and you store the ciphertext, and the secret (maybe as env. variable), and pass the decoded pass to mailer.

Example:

<?php
$secret_key = 'supersecret key';
$password = 'somepass';

// encrypt
// calculate cipher, and store somewhere
$cipher = mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $secret_key, $password, MCRYPT_MODE_ECB);

// use the cipher
$mail->Username = $USR_EMAIL; // SMTP username
$mail->Password = mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $secret_key, $cipher, MCRYPT_MODE_ECB); // SMTP password
?>