CODEWITHSUNDEEP
php
PHP
PHP

Reputation: 216

Best method for storing mysql passwords?

What do you use? What are the benefits of using it?

Gimme the lowdown on all the techniques, pros and cons all the tutorials don't tell you about.

Upvotes: 0

Views: 4914

Answers (6)

Sameer Parwani
Sameer Parwani

Reputation: 309

To keep things simple use md5 with a salt. MD5 is a one way hash. For example:

md5("hello") = "5d41402abc4b2a76b9719d911017c592"

So, without salts, you end up saving "5d41402abc4b2a76b9719d911017c592" into your database. Then when one tries to login by inputting their password you compare the md5 of the inputted password with the md5 you saved.

if (md5($input_password) == "5d41402abc4b2a76b9719d911017c592")
    log_in_user();

However, md5 is insecure, as is because the md5 of x is always y. So, if one were to compromise your database and find the password listed as "y" then you know the password is "x" if you've created or downloaded a md5 lookup table.

Instead do something like:

$password_to_save_to_db = md5(md5($input_password . $date_user_registered));

Therefore each user will have their own unique salt and those lookup tables will be rendered useless. (It could be re-created for each password the hacker wants to steal, but that's much more time consuming and plus the double md5 makes things a little more difficult.

You can read more at http://sameerparwani.com/posts/using-salts-for-extra-security

Upvotes: -1

Sufendy
Sufendy

Reputation: 1242

Hashing is common in storing password. But they are all the same, just that the longer the hash result it produced, the harder it is to be hacked. The hashing result from the same hash function normally having the same length. Without restriction on the input text (which is unlimited in length), you might produce 1 same hash string from multiple sentences/words. This is where the hole lie. Read more about pigeonhole principle and Birthday Attack

I normally use MD5(). But it's out of the standard already I guess because some of the collision something. Somehow people invented a system that can detect 1 hashed string with more than one real string.

use SHA instead. To make it more secured, you could add $salt on it, Make it a double protections, so, hash the actual password first, add the salt to the hashed password, then hash them again.

Remember, the longer the result string, the better it is.

some recommend bcrypt, but I never use it before.

Upvotes: 1

Chris McClellan
Chris McClellan

Reputation: 1105

You'll want to store the original password like this

md5($password)

Your login script schould be like this:

$sql = "SELECT `id` WHERE username=`$username` AND password=`" . md5($password) . "`";
$result = mysql_query($sql,$link);
if (mysql_num_rows($result) == 1) {
  // user is authenticated
}

This should actually be more complicated, but for conceptualization its been simplified.

Upvotes: 0

Nabeel
Nabeel

Reputation: 557

You can use a combination of two or more encryption algorithms. For example: 

md5(sha1($password));

or just like this:

md5(md5($password));

Upvotes: -1

PPC-Coder
PPC-Coder

Reputation: 3632

The short answer is: you don't. What you actually store is the result of running the user's password through a one way hash-function. Before I would have thought using something like MD5 would be fine until I read this and would recommend looking at bcrypt instead since it can help against brute-force attacks.

Upvotes: 8

Arun David
Arun David

Reputation: 2784

The simple but secured way of storing password is to use the MD5 encription.

md5($password);

will give the md5 encrypted value.

Upvotes: -1

Related Questions