How does one see that the user has typed in the correct password to log in?
This is the same (a bunch of combinations ...) I am doing:
As I can see from ouput, there is something wrong with mysql_result bit , But I am not able to understand correctly.
I think That you are accumulating a hash of password in the database, but for the benefit of other readers, how much No Store passwords in plain text in the database You do not want to be!
You should use a strong hashing function from MD5 () . You should use the SHA256 function to have this hash method available in PHP.
You must also apply random for the password to store a different salt value for each user's account. More attacks Rana helps.
You should learn to use extensions instead of the old MySQL extension. Mysqli supports parameterized queries, so that you can weaken some SQL injection attacks.
Here is some example code I have not tested it, but it should be very close to work:
$ input_login = $ _POST ['login'] ; $ Input_password = $ _POST ['password']; $ Stmt = $ mysqli- & gt; Ready (select "password, salt customer WHERE login =?"); $ Stmt- & gt; Dam_prim ("s", $ input_login); $ Stmt- & gt; Executed (); $ Stmt- & gt; Tie-specific ($ password_hash, $ salt); While ($ stmt-> fetch ()) {$ input_password_hash = hash ('sha256', $ input_password. $ Salt); If ($ input_password_hash == $ password_hash) {return true; } / / You want to log in to unsuccessful password attempts for password here, // security for auditing or locking an account with a lot of efforts in a short time. } $ Stmt- & gt; Close (); // no lines match $ input_login, or other password returns do not match false; Some others suggest that the query should be checked for login =? And password =? But I do not like to do this if you do this, you can not know that lookup fails because the login was not present, or because the user provided wrong password.
Of course you should not disclose to the user that failed login attempts, but you may need to know you , so that you can log suspicious activity.
@Javier has said in your reply that you should not retrieve the password (or the password hash in this case) from the database. I do not agree.
Call Xavier to code md5 () and send the resulting string as a result to the database. But this password does not support lying easily. Before you havehed in PHP, you have to do a different query to get this user's salt.
Alternatives Sending plain text passwords to your php app on the network Your database server can view this password by wiretapping your network. If you have the SQL questions being logged, then anyone who accesses the log can see the password. Inspired hackers can also dumpster-dive to find old file system backup media, and read log files in that way!
The minimum risk is, to bring the password hash string into the PHP app from the database, compare it to the hash of the user's input (also in PHP code), and then discard these variables.
Comments
Post a Comment