Question

I’m currently doing a very safe login system, but I’m new to the crypt() function and need some quick assistance.

I used crypt() to encrypt the password string during signup and saved it to the database. However, how will I be able to decrypt the key during login? Or how am I supposed to do otherwise? Or would it be possibly to do some magic with the submitted password string to compare it to the encrypted key in the database?

Answer 1

crypt() doesn’t encrypt passwords, it hashes them. The fundamental difference is, you can’t get hashed passwords back (think of hash browns – if you have hash browns, you can’t get the potatoes back).

So you apply the same function to the input and compare its result to the value stored in the database:

$stored_pw = get_hashed_password_from_db($_POST['username']);
crypt($_POST['password'], $stored_pw) == $stored_pw

Read the documentation on crypt() to understand the “magic” behind the code above works.