Question

I want a form where user can change password. I am able to encrypt a password, however when it is selected from the database(the original password say ‘test’) it does not recognise it.

This is when the password has been encrypted in db. i am checking to see if the typed password in form matches the one in the db:

SELECT * from table where password = md5('$typed_password')

This is how it is encrypted:

UPDATE table set field = md5('$typed_password' )

How can my select work so that when a user types it in the form the original one is recognied?

Answer 1

firstly: MD5 is a cryptographic hash function, not necessarily an encryption method. A hash is designed to only be performed in one direction, and cannot be reversed. (this is a good thing)

MD5 is however cryptographically broken (not considered secure anymore); you should use another hash function (preferable Bcrypt-hash or at least SHA256)

Looking at the code, I can see several things wrong:

1. your password is not salted
2. I really hope that $typed_password is properly sanitized or you are in for SQL-injection.
3. You try to select all users from the table with the same password.

The easiest (and probably best) way of doing passwords is by using a standard library: the Portable PHP password hashing framework and make sure you use the CRYPT_BLOWFISH algorithm.

require('PasswordHash.php');

$pwdHasher = new PasswordHash(8, FALSE);

// $hash is what you would store in your database
$hash = $pwdHasher->HashPassword( $password );

// $hash would be the $hash stored in your database for this user
$checked = $pwdHasher->CheckPassword($password, $hash);
if ($checked) {
    echo 'password correct';
} else {
    echo 'wrong credentials';
}

the store/check/update queries should be bound to the user’s Id:

// Insert query
$query = "INSERT INTO users VALUES({$userId}, '{$username}', '{$hash}')";

// Select query
$query = "SELECT hash FROM users WHERE userId = {$userId}";

// Update query
$query = "UPDATE users SET hash = '{$hash}' WHERE userId = {$userId}";

And then, you should use parametrised queries instead of directly passing the variable values into the query.

I realise this is a lot of info at once, but it is vital learn this if you do not want your script to be hackable by almost every programmer out there.