Question

When I generate an unsalted hash with SHA1 in PHP it is different than when I let my MySQL server handle it. Why is this?

Is there any way I can fix this so the hashes are the same? I’m guessing it’s too late if the hashes have already been generated?

<?php
$p = 'password';

$p2 = SHA1('$p');

...INSERT INTO table (pass1, pass2) VALUES (SHA1('$p'), '$p2')...


?>

EDIT:

It looks like it is hashing “sha1(‘$p’)” instead of the password.

EDIT2:

And I’m an idiot. I put ” in the SHA1. Oops!

Sorry for wasting your time

Answer 1

This code:

$p2 = SHA1('$p');

Will actually hash the literal $p, not the content of $p. You should do:

$p2 = SHA1($p);

This is because variables and escape sequences are not interpreted by PHP when using single quotes. This is mentioned in the manual:

Note: Unlike the double-quoted and heredoc syntaxes, variables and escape sequences for special characters will not be expanded when they occur in single quoted strings.