Hello,

 

I have a table with a Password field that I want to be encrypted so that I won't be able to see everyone's passwords. I've seen it done before but can no longer find the site that explained how to do it.

 

Can anyone help?

 

Thanks,

Adam

How we can get password??

You can use some mysql encryption functions like SHA1 or MD5.

I'm not sure how you can update the database now but you can easily encrypt each password when you register it into the database

in php it would be

<?php
mysql_query("INSERT INTO authorization (password) VALUES (SHA1('$pass'))");
?>

considering the field is called "password", the variable that stores the users password is called "$pass" and your table is "authorization"

SHA1 always creates a fix 40char encryption and MD5 a 32char one.

and these functions can be used in php too so

to check a login if the pass is correct I think you could use this:

if (sha1($_POST['password']) == $fetched_array['password'])
{
login 
}

Edited February 7, 201016 yr by Sam G
added [code] tags

As stefyx said, the above PHP script will register the password the same way but change it's appearance to the relevant hash, so it becomes encrypted and just a string of alphanumberic characters in the database. Also, I recommend MD5 personally. Just edit the insertion query as required to replace your current one.

Assuming $username,$password and $emailaddress are coming from a form.

 

<?php
$Query = "INSERT INTO tblUsers (username,password,emailaddress) VALUES ('$username',MD5('$password'),'$emailaddress')";
?>

 

Also, to change all of the current passwords in the database, you'll need to either;

1) Do it manually; Edit every single entry in the database, click the "Paint Brush" Edit icon, and in the drop down box next to the password field on the update screen, select "MD5" It'll then encrypt the data.

2) Run a query in the phpMyAdmin query window to update them all.

 

I might also add, if you're using a login system, as said above, don't forget that the login system will have to be altered to understand the MD5 Hash. It's pretty much done the same way as above. Just when you SELECT the user info from the DB to validate, use MD5;

 

<?php
$Query = "SELECT username,password FROM tblUsers WHERE username='$username',password=MD5('$password')";
?>

 

Ect. Ect. It's probably best to use some alternate validation that matches rather than selects but you get the general idea.

Edited February 7, 201016 yr by Sam G
added [code] tags

Just what I was looking for. Thank you!

The encruption worked perfectly, but when I tried to log in again, I keep getting "Wrong user name or password".

 

What am I doing wrong?

 

<?php

session_start();

$host="****"; // Host name
$username="***"; // Mysql username
$password="***"; // Mysql password
$db_name="***"; // Database name
$tbl_name="users"; // Table name

// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");

// username and password sent from form
$NickName=$_POST['NickName'];
$Password=$_POST['Password'];

// To protect MySQL injection (more detail about MySQL injection)
$NickName = stripslashes($NickName);
$Password = stripslashes($Password);
$NickName = mysql_real_escape_string($NickName);
$Password = mysql_real_escape_string($Password);

$sql="SELECT * FROM $tbl_name WHERE NickName='$NickName' and Password=MD5('$Password')";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

if($count==1){
// Register $myusername, $mypassword and redirect to file "login_success.php"

while($row=mysql_fetch_array($result))
{

extract($row);
	$_SESSION['ID']=$ID;
$_SESSION['FirstName']=$FirstName;
$_SESSION['LastName']=$LastName;
$_SESSION['NickName']=$NickName;
$_SESSION['Email']=$Email;
$_SESSION['UserType']=$UserType;
}

header('Location: /member/');
}
else {
echo "Wrong Username or Password";
} ?>