CODEWITHSUNDEEP
phpmysqlpdo
Bram Raaijmakers
Bram Raaijmakers

Reputation: 67

Updating md5 passwords with the php password_hash function

I have a database with accounts that still use the MD5 algorithm which is old and unsafe, so I wanted to update the passwords with the password_hash function in php.

I made a login for users with a md5 password so they can be prompted with an update field to update their password. It all works and I see the new hash string in the database. But when I want to login using their new password it's just not possible.

I use a PDO update query to update the passwords, does anyone have a solution or know if this is even possible?

Thanks in advance, Bram.

EDIT:

This is the code I use to verify the passwords.

if (password_verify($password, $rowofusers['passwordhere'])) {
       //code here
      }

Upvotes: 2

Views: 1570

Answers (1)

Sherif
Sherif

Reputation: 11943

As mentioned, the correct way to do this can be completely transparent to the user and should not require an "update password prompt".

When the user tries to log in take the following steps to modify your login process accordingly.

  1. Check if the hash in the db starts with $2y$ to determine if the password should be check with md5 or password_verify. If it does start with $2y$ then just use password_verify and ignore the remaining steps (continuing on with the rest of your normal login process).
  2. If the password hash in the database does not start with $2y$ then first, check the plain-text password against its md5 hash.
  3. If the plain-text password's hash doesn't matches the md5 hash in your database continue with normal failed authentication process and ignore the remaining steps here
  4. If the plain-text password's hash does match the md5 hash in your database then take the plain-text password and run it through password_hash and update your database with the newly generated BCRYPT hash from password_hash.

You would have to keep this code in your login process until all passwords in your database have been updated and no remaining md5 hashes are left. The user will never know that their password hash is updated and never be prompted to enter their password twice as it's completely unnecessary.

Upvotes: 3

Related Questions