CODEWITHSUNDEEP
php
swift_USer
swift_USer

Reputation: 159

sha1() for Password hashing

I am using sha1 for my password security. I have stored password in this way in register.php 

// secure password
$salt = openssl_random_pseudo_bytes(20);
$secured_password = sha1($password . $salt);

//Send it to mysql table
$result = $access->registerUser($username, $secured_password, $salt, $email, $fullname);

This all is working fine.

Problem is here:

In my login.php

 $password = htmlentities($_POST["password"]);
$secure_password = $user["password"];
$salt = $user["salt"];


// 4.2 Check if entered passwords match with password from database
if ($secure_password == sha1($password . $salt)) {
//do something 
} else {

//do something
 }

I am always getting as password does not match. where am I going wrong?

Upvotes: 2

Views: 6897

Answers (1)

xXAlphaManXx
xXAlphaManXx

Reputation: 161

First is first. NEVER USE SHA OR MCRYPT TO STORE YOUR PASSWORD.

EDIT : The password_hash() function generates a long password hash, so make sure that your column in the mysql is a VARCHAR of 500 space

All these useless practises is the root reason why almost many websites get hacked. To tackle the situation, php did a lot of research and then at last came with the most secure function called the password_hash(). I am not more onto explaining about password_hash() here as there are already many documents on the internet.

You can always hash a password like this

<?php

$securePassword = password_hash($_POST['password'], PASSWORD_DEFAULT);

$query = $db->query('INSERT INTO users ......');

?>

And, to verify the password, you can simply use this function

<?php

$passwordHash = $query['password']; //Password from database
$userPassword = $_POST['password']; //Password from form

if(password_verify($userPassword, $passwordHash)) {
    echo 'Password is correct, logged in!';
} else {
    echo 'Password is wrong, try again';
}

?>

And, answer for your question.

PLEASE DON'T USE SHA OR MCRYPT OR BCRYPT. IF YOU WANNA GET YOUR WEBSITE HACKED, THEN CONTINUE. OR USE password_hash()

The reason you don't get the hash genereated each time because the openssl_random_pseudo_bytes() generates random numbers each time. So each time, during execution, the function returns different numbers and you get your sha result wrong and thus giving a FALSE alert.

PLEASE, AGAIN. I BEG YOU TO USE password_hash() FUNCTION

For more information on password_hash() and password_verify() :

Upvotes: 7

Related Questions