Home/ Questions/Q 748473
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-14T14:19:28+00:00

So I am making a basic log-in page. I have a good idea of

  • 0

So I am making a basic log-in page. I have a good idea of what to do, but I’m still unsure of some things.

I have a database full of students and a password column of course. I know I’m going to use md5 encryption in that column. The student enters their e-mail and student ID, and they get e-mailed a password if correct.

But, where do I create the password? Do I have to manually add the password (which is just a randomly generated string) in mySQL to all the students? And I am suppose to send the password to the student; how will I know what to send the student if the password is encrypted?

I was thinking about generating the password when the student first enters their e-mail and student ID. They get an e-mail of the random string, and at the same time, I add the same random string to the database, encrypted.

Is that how it’s suppose to work though? And it feels unsafe doing that all on the same page.

Sorry for the long-winded, newbish question. I find this all facisnating at the same time as well (AES and RSA encryption :O)

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    A few things here:

    1. You aren’t really encrypting it, you’re hashing it. Easy thing for newbies to confuse, but just wanted to get that out of the way.

    2. Don’t use MD5, it’s just not a very secure hash. Use one of the SHA variants instead if possible.

    3. Don’t just hash the password, you’ll want to “salt” it too. Basicly this involves adding a random string to the password before you hash it, and storing that random string somewhere where you can retrieve it later (so that you can validate the hash when the user enters their password). This helps prevent against pre-computed dictionary attacks.

    As for generating the password, I think you are on the right track – I would just generate it when they create their account, email it to them, then hash it and store the hashed (and a random salt) on the user record in the DB.

    • 0