31 replies to this topic

[Demonslay]

MD5 is a one-way encryption algorithm. All you are doing, is taking your string, encrypting it so no-one could possibly tell what the original string was, and compare it to the stored value, which is the encrypted version of the password.

So, when registering and making a password, the password is encrypted (for more security use more than one encryption method and use salts and peppers), and stored in the database. When you log in, the user's submitted password is encrypted with the exact same algorithm and scheme, and compared to the database's stored value of the encrypted password submitted at registration.

All simple stuff, and to learn more on encryption, there's tons of tutorials and articles you can find here on P2L, or more in-depth by searching Google.

[pirateXcore]

That will almost work (actually it might work idk).
Might try

$password = $_GET['pass'];
$password = md5($password);

Then have it insert password into the database after it's been encrypted.

And do the same thing when logging in. Then compare the md5 password they used to login with the password in the database.

[Mr. Matt]

How about post your code so we can see what is wrong?

[Demonslay]

See, you aren't even encrypting it when you are registering a new member.

Simply run the password through md5() and whatever encryption method you chose, and use the same method when comparing for login.

[Demonslay]

Well, usually what we mean when we want code, is whatever you currently have.

Please show us both the registration code, and the login code, both with your attempts at using encryption.

[Demonslay]

Pfft, no wonder. I didn't even pay attention to the fact you are using sprintf(), and why now that you tell me that it is a SQL error, thats simple.

You have to use quotes for strings in SQL; complete basics there. Otherwise it assumes it to be a column name or a function of some sort.

sprintf("INSERT INTO members (name, avatar, pass, cat) VALUES ('%s', '%s', '%s', '%s')",

					   GetSQLValueString($_POST['name'], "text"),
					   GetSQLValueString($_POST['avatar'], "text"),
					   GetSQLValueString($_POST['pass'], "text"),
					   GetSQLValueString($_POST['name'], "text"));

[nitr0x]

Well if you ask me that's a pretty odd way of inserting into a database anyway. You could try something like this.

$password = md5($_POST['pass']);

mysql_query("INSERT INTO `members` (`name`,`avatar`,`pass`,`cat`) VALUES ('$name','$avatar','$password','$cat')")or die(mysql_error());

Obviously when registering, you would also want to make sure the username hasn't already been taken, plus check to make sure the fields have been entered, etc. and security measures.

If you need any help on all this, then feel free to post here or PM me.

[nitr0x]

With the login, you need to convert the password to the encrypted string, then select from the table where the username is what they entered, and make sure that the two passwords are the same. Example:

$user = $_POST['user'];
$pass = md5( $_POST['pass'] );

$query = mysql_query("SELECT * FROM `members` WHERE `username` = '$user'")or die(mysql_error());
$data = mysql_fetch_object($query);

if( $pass == $data->pass ){
//Correct information, set cookie or sessions or whatever you're using.
}else{
print 'Incorrect username or password
}

Edit:

Well I'm gunna have to go now, but if you get any more problems, just post em here and I'm sure demonslay or someone similar will be here to help you soon.

Edited by nitr0x, 16 August 2007 - 06:30 PM.

[.CJ]

I'd like to try and help, though I can't guarantee a success.

When you submit the login form, the password will be stored in:

$_POST['password']

You'll need to encrypt it, so put it into a variable:

$password = md5($_POST['password']);

Now you need to grab your user's info from the database. I will assume you know how to connect and select a database. When the form is submitted, you need to check if the password provided matches the password in the database, which might I add, should be encrypted anyway, this should of been done when inserting the user's data into the database after they registered.

if(isset($_POST['submit'])) {
	$query = 'SELECT * FROM {TABLE NAME}';
	$row = mysql_fetch_object($query);
	
	if($row->password == $password) {
		echo('Hooray, your logged in!');
	}
	else {
		echo('Not logged in!');
	}
}

As I stated, this isn't guaranteed to work, I'm just giving a helping hand. Good luck and hope you sort out your problem.

- Chris

Edited by .CJ, 16 August 2007 - 06:38 PM.

[Demonslay]

Bottom line: never trust a program to write a program for you!
Goodness, the code Dreamweaver produces is weak, to say the least. And can be quite confusing at times.

This is seriously coding 101. I would like to see the source code for this GetSQLValueString() function, and if it actually enters quote marks on its return.

To nitr0x: using sprintf() is not an 'odd way of inserting'. It is actually the recommend way of executing SQL queries by php.net.

Lol, what is this supposed to accomplish? Because of the 'false' boolean, this will never be executed.

if (isset($_SESSION['PrevUrl']) && false) {
	  $MM_redirectLoginSuccess = $_SESSION['PrevUrl'];	
	}