Hi,

 

Im having trouble getting password hashing to work. When I add the sha1 to my password I cant login but it works without using hashing.

 

Login code

 

function login(){

	if($_POST["email"] && $_POST["password"]){
		$get_email = $_POST['email'];
		$email = mysql_real_escape_string($get_email);
		$password = sha1($_POST['password']);
		$result = mysql_query("SELECT ID, Name, Email, Password, isAdmin from People			where Email='". $email ."' and Password='". $password ."'"
		)  or die("Query failed with error: ".mysql_error());    


       if($row = mysql_fetch_array($result)){


			session_start();

			$_SESSION['id'] = $row['ID'];
			$_SESSION['name'] = $row['Name'];
			$_SESSION['email'] = $row['Email'];
			$_SESSION['password'] = sha1($row['Password']);
			$_SESSION['isAdmin'] = $row['isAdmin'];

			$GLOBALS['main'] = "Login Sucessful";		
		}
		else{
			$GLOBALS['main'] = "Login failed";
		}	
	}					
}

 

the update profile page is where the password is first converted into a hash password as there will not be a register user page

 

The code is

 

<?php
include_once('functions/db.php');

$updated = false;
session_start();
$personID = $_SESSION['id'];	

$result = mysql_query("SELECT Name, Email, Password, isAdmin FROM people WHERE ID='$personID'") or die("Query failed with error: ".mysql_error());

if($row = mysql_fetch_array($result)){
$name = $row['Name'];
$email = $row['Email'];
$password = $row['Password'];

}

$function = $_GET['function'];

if($function == "updateDetails"){

$name = $_POST['name'];
$getEmail = $_POST['email'];
$email = mysql_real_escape_string($getEmail);
$password = sha1($_POST['password']);
mysql_query("UPDATE People SET Name = '".$name."', Email = '".$email."', Password = '".$password."' WHERE ID = '".$personID."';") or die("Query failed with error: ".mysql_error());
$updated = true;
}

?>

Worked it out, it was the password field in the database only allowed 20 characters

Nice catch.

Nice find, I was looking at the code, thinking "this should be working"

 

however, I personally, would not store the password or the access level in the session, this is easy the intercept and then crack.

 

I would do this :

1) user registers, store name, email, password, isAdmin (you have done perfectly)

2) user logs in, check credentials, add a session['id'] add a session['token']

- The token is made up of md5(session_id.$row['email'].$row['email'])

 

3) whenever the user access a secure page run a simple query :

- $result = mysql_query("SELECT Email, Password, isAdmin from People where ID='". $_SESSION['id'])." LIMIT 1"

- $row = mysql_fetch_array($result)

- now generate a validation token $validToken = md5(session_id.$row['email'].$row['email'])

- $isAdmin= $row['isAdmin']

- now compare session token to valid token

- if($_SESSION['token'] == $validToken) // valid user

- /* for an admin page*/

if($_SESSION['token'] == $validToken && $isAdmin) // valid user

 

 

Also, are your storing the passwords in plain text ? You seem to be hashing it again when storing the session ?

$_SESSION['password'] = sha1($row['Password']);

 

 

here is a class I created for creating secure tokens

 

 

// example of codes class usage

$adminRequired = true; // initialize the variable
$hasAccess = true;// initialize the variable
$id = 0; // initialize the variable
if(!isset($_SESSION['id']) || !isset($_SESSION['token'])){die('no session set'}; } // check that user has logged in
// get row with valid credentials
   $result = mysql_query("SELECT Email, Password, isAdmin from People where ID='". $_SESSION['id'])." LIMIT 1"; 	$row = mysql_fetch_array($result);
// end get row with valid credentialsif(!$row){die('invalid user'}; }
if($[font="monospace"][size="2"]adminRequired && $row['isAdmin'] == 0[/size][/font]){ [font="monospace"][size="2"]$hasAccess = false[/size][/font] }  // check access level
$tokenClass = new codes(); // new instance of codes class
$validToken = $tokenClass->[font="monospace"][size="2"]GenerateID($row[email],$[/size][/font][font="monospace"][size="2"]row[password][/size][/font][font="monospace"][size="2"]); [/size][/font]// generate a valid token for this id

if($_SESSION['token'] == $validToken && $hasAccess){ /* handle valid user */ }

 

<?php 	
 ########################################################################################
 ###                                                                                  ###
 ###             		ENCRYPTING AND CODE GENERATION CLASS                 		###
 ###                                                                                  ###
 ########################################################################################

 class codes
 {
   /*
	* string encrypting function generates a secure string from a string
	* access = public
	* param = $string
	* return string       		
   */
   public function cryptMe($string) 
   {
     $Crypt = hash('sha512',($string)); // first hash the string 
     $Crypt = str_ireplace(array("W","D","F","R","L","O"),"",$Crypt); // random characters are removed, change this 
     $Crypt = hash('sha512',($Crypt)); // hash again
     return $Crypt;   // return unique code 
   }  

   /*
	* Secure token generator function
	* access = public
	* param = $username,$password
	* return string 
	* 
	* this function uses the cryptMe function                        
   */    
   public function GenerateID($username,$password)
   {
     // generate a totally unique key based on username, password and session ID  
     return $this->__cryptMe(sha1($username) . sha1($password) . sha1(session_id()));
   } 
 } 
?>[/size][/font]
[font="monospace"][size="2"]

	
       $UN_Encrypted_pass = $_POST['password'];
$salt = "iuhfni389729d29iu";
$pass = hash('sha512', hash('sha1', $UN_Encrypted_pass) . hash('sha512', hash('md5', $UN_Encrypted_pass) . $salt)); 

 

Why not use this to secure you're passwords, a friend gave it to me and i am having create success with it!

	
       $UN_Encrypted_pass = $_POST['password'];
$salt = "iuhfni389729d29iu";
$pass = hash('sha512', hash('sha1', $UN_Encrypted_pass) . hash('sha512', hash('md5', $UN_Encrypted_pass) . $salt)); 

 

Why not use this to secure you're passwords, a friend gave it to me and i am having create success with it!

 

 

that is also fine, the only difference (in my opinion) is that if many users have a common password then they would all be the same in the database eg:

 

for the password: "password" the above generates (regardless of username) :

 

37bdb2185fe04224a5a7b6381390ee3b67b4fba50ef1c73d69fd217bcf964950f652ebf7a57b44a2be77fa5866f3b4182c75d21fff9e3dc34668d47989838cc5

 

by using the username in the hashing we could have 2 users 1st user is "bob" 2nd user is "john" both with "password" as their passwords by changing the hash to this :

   $pass = hash('sha512', hash('sha1', $UN_Encrypted_pass) . hash('sha512', hash('md5', $userName) . $salt));

 

 

bob generates :

 

d29325d5cc8bed4f49bfb38d394d681b061f15546449f0d09d1369af4961dfdc762040bfe3b162464671d2eaba2c128a0b4580e347f6683441950e8c89f0be68

 

whilst john generates :

 

f44d9e59db05b068dad176f03a6512ca7647fefcf9dba0b4f3f8c5bde8da04c6f408bb9898a6d5a4b71feab56c5987d808d608368b2afec4da217033f7bba197

 

this makes it a little bit more cryptic I think.

 

what do you think ?

Or you could have a salt row in the table and generate a random salt for each user then combine that with the password, to avoid duplicates, rather than having a static salt. Just another way to do it, there seem to be numerous ways of doing this.