Question

I’m trying to compare the value of the password stored in the database (which is done by md5($mypassword)), but every time I enter a different password than what is in the DB it still allows me to auth the user… I’ve tried:

$rslt['password'] = md5($mypassword)
$rslt['password'] == md5($mypassword)
$rslt['password'] === md5($mypassword)

but neither of them seem to work.

---

a snippet of the code is below:

if((mysql_num_rows($qry)==1)&&($rslt['username']==$myusername)&&($rslt['password'] == md5($mypassword)))
    {
    echo $rslt['username'];
    echo $myusername;
    echo $rslt['password'];
    echo md5($mypassword);
    //$expire=time()+60*60*24*30;
    //$_SESSION['user'] = $rslt['username'];
    //header("location: ../acct_beta.php");
    }

any ideas would be helpful. thanks 😀

Answer 1

You could turn the logic around a bit and let mysql do the comparison by using

select count(*) from <table> where username = @username and password = MD5(@password)

If the count > 0 then it’s authenticated.