Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > comp.lang.php > #17672

Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC

Path csiph.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From "J.O. Aho" <user@example.net>
Newsgroups comp.lang.php
Subject Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC
Date Tue, 23 Jan 2018 18:58:41 +0100
Lines 236
Message-ID <fcpbeiF1mhdU1@mid.individual.net> (permalink)
References <f6e88bc0-e17c-4045-80b4-b15bcd00825d@googlegroups.com>
Mime-Version 1.0
Content-Type text/plain; charset=utf-8
Content-Transfer-Encoding 7bit
X-Trace individual.net /OiINcQ+/g8w+mZuT7MnNghpztxjEuJyer/i3Af5FKKrjYmE8p
Cancel-Lock sha1:/6hFwxP9GJLS6cJFTM0oCKKIQ0A=
User-Agent Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0
In-Reply-To <f6e88bc0-e17c-4045-80b4-b15bcd00825d@googlegroups.com>
Content-Language en-GB
Xref csiph.com comp.lang.php:17672

Show key headers only | View raw


On 01/23/18 10:26, Timothy Steele wrote:
> Please i need help i have a voting system which allow me to add user as admin. in the process of adding the user i use a salt password hashing technic and is work perfectly that is when i what to add a user. The problem is that the user can not login and i have try but no way for me. The codes pasted below.
> 
> ****first if the codes that allow me to add user to the tabase**** add_user.php

I would recommend you do the hashing in the database layer. Then you
don't need to pull the salt to the php-layer.


> <?php  
>  global $db;
> // require("../config/db.php");
>  global  $error1,  $error2, $error3, $error4;
> $full_name = $username = $password = "";
> 
> 
> if(isset($_POST['submit'])){
>     $username = $_POST['username'];
>     $ad_password = $_POST['password'];
>     $full_name = $_POST['full_name'];
> 
>     $sql_query = mysqli_query($db, "SELECT username FROM admin WHERE username = '{$username}' ");
>     $count = mysqli_num_rows($sql_query);
> 
>     $sql_salt = mysqli_query($db, "SELECT randSaltPass FROM admin");
>     $row = mysqli_fetch_array($sql_salt);
>     $salt = $row['randSaltPass'];        
>     $password = crypt($ad_password, $salt);
> 
>     if(!empty($username) && !empty($ad_password) && !empty($full_name)){
> 
>         if($count > 0){
>             $error1 = "<div class='alert alert-danger'>
>                   <a href='#' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
>                   Username  Already Exists.
>                 </div>";
>         }else{
> 
>          $u_name     = mysqli_real_escape_string($db, $username);
>          $pass_word  = mysqli_real_escape_string($db, $ad_password);
What's the point of this? $pass_word is just used in a regex and you
don't need to mysql escape it when you don't use it in the SQL.


>          $admin_name     = mysqli_real_escape_string($db, $full_name);
> 
>           if(!preg_match('/^[a-zA-Z]*$/', $u_name)){
> 
>              $error2 ="<div class='alert alert-danger'>
>               <a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
>                    Only Leters are Allowed  For Username.
>              </div>";
>           }
>           if(!preg_match('/^[a-zA-Z]*$/', $admin_name)){
>              $error3 ="<div class='alert alert-danger'>
>               <a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
>                    Only Leters are Allowed  For Fullname.
>              </div>";
>           }
> 
>           if(!preg_match('/^\S*(?=\S{7,15})(?=\S*[a-z])(?=\S*[A-Z])(?=\S*[\d])\S*$/', $pass_word)){
>             $error4 ="<div class='alert alert-danger'>
>               <a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
>                   Password Must Be Between 7 and 15 Characters and Must Contain At Least One Lowercase Letter one uppercase Letter and One Digit.
>              </div>";
>           }
> 
> 
>           if((preg_match('/^[a-zA-Z]*$/', $u_name)) && (preg_match('/^[a-zA-Z]*$/', $admin_name)) && (preg_match('/^\S*(?=\S{7,15})(?=\S*[a-z])(?=\S*[A-Z])(?=\S*[\d])\S*$/', $pass_word))){
> 
> 
>              $sql = "INSERT INTO admin(username, password, admin_name) VALUES('{$u_name}', '{$password}', '{$admin_name}' )";
> 
>              $query = mysqli_query($db, $sql);
> 
>              if(!$query){
>                 die("QUERY FAILED " . mysqli_error($db));
>              }
> 
>           }
> 
> 
>         }
> 
>     }else{
> 
>         if(empty($username)){
>             $error2="<div class='alert alert-danger'>
>           <a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
>                Username Can Be Empty.
>            </div>";
>         }
>         if(empty($full_name)){
>             $error3="<div class='alert alert-danger'>
>           <a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
>                Fullname Can Be Empty.
>            </div>";
>         }
>         if(empty($password)){
>             $error4="<div class='alert alert-danger'>
>           <a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
>                 Password Can Be Empty.
>            </div>";
>         }
> 
>     }
> 
> }
> 
> 
> 
>  ?>
> 
> 
> Second is the code that allow user to login but the problem is i do not Know where i will hash so that user will be able to login
> 
> Admin_login.php
> 
> 
> 
> 
> class Admin_Login
> {
>     private $_username;
>     private $_password;
> 
>     public function __construct($c_username, $c_password) {
>         $this->_username = $c_username;
>         $this->_password = md5($c_password);

Password ain't salted, so you can't compare that to the result from
crypt() which could use something else than md5 (md5 ain't safe to use
for passwords, use at least sha2).
> 
>         //  $sql_salt = mysqli_query($db, "SELECT randSaltPass FROM admin");
>         // $row = mysqli_fetch_array($sql_salt);
>         // $salt = $row['randSaltPass'];        
>         // $password = crypt($db, $salt);
>     }
> 
>     public function AdminLogin() {
>         global $db;
> 
>         //Start session
>         session_start();
> 
>         //Array to validate errors
>         $error_msg_array = array();
> 
>         //Error messages
>         $error_msg = FALSE;
> 
>         if($this->_username == "") {
>             $error_msg_array[] = "Please input your username";
>             $error_msg = TRUE;
>         }
> 
>         if($this->_password == "") {
>             $error_msg_array[] = "Please input your password";
>             $error_msg = TRUE;
>         }
> 
>         if($error_msg) {
>             $_SESSION['ERROR_MSG_ARR'] = $error_msg_array;
>             header("location: http://localhost/voting_system/sandbox/index.php");
>             exit();
>         }
> 
>         $sql = "SELECT * FROM admin WHERE username = ? AND password = ? LIMIT 1";
>         if(!$stmt = $db->prepare($sql)) {
>             echo $stmt->error;
>         } else {
>             $stmt->bind_param("ss", $this->_username, $this->_password);
>             $stmt->execute();
>             $result = $stmt->get_result();
>         }
> 
>         if($result->num_rows > 0) {
>             //Login successful
>             $row = $result->fetch_assoc();
> 
>             //Create session
>             session_regenerate_id();
>             $_SESSION['ADMIN_ID']   = $row["id"];
>             $_SESSION['ADMIN_NAME'] = $row["name"];
>             session_write_close();
> 
>             header("location: http://localhost/voting_system/sandbox/admin_page.php");
> 
>         } else {
>             //Login failed
>             $error_msg_array[] = "The username and password you entered is incorrect.";
>             $error_msg = TRUE;
> 
>             if($error_msg) {
>                 $_SESSION['ERROR_MSG_ARR'] = $error_msg_array;
>                 header("location: http://localhost/voting_system/sandbox/index.php");
>                 exit();
>             }
>             $stmt->free_result();
>         }
>         $result->free();
>         return $result;
>     }
> }
> 
> 
> 
> 
> login.php
> 
> 
> <?php
> //Include database connection
> require("../../config/db.php");
> 
> //Include class Admin_Login
> require("../classes/Admin_Login.php");
> 
> if(isset($_POST['submit'])) {
> 
>     //Create variable to store post array values
>     $username = trim($_POST['username']);
>     $password = trim($_POST['password']);
quite bad if you have an ending/starting space in your password.

> 
>     $adminLogin = new Admin_Login($username, $password);
>     $rtnAdminLogin = $adminLogin->AdminLogin();
> 
> }
> 

-- 

 //Aho

Back to comp.lang.php | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC Timothy Steele <steeletimothy2000@gmail.com> - 2018-01-23 01:26 -0800
  Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC Jerry Stuckle <jstucklex@attglobal.net> - 2018-01-23 08:01 -0500
    Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC "J.O. Aho" <user@example.net> - 2018-01-23 18:59 +0100
    Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC Arno Welzel <usenet@arnowelzel.de> - 2018-09-05 09:37 +0200
      Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC tony@mountifield.org (Tony Mountifield) - 2018-09-05 10:19 +0000
        Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC "Christoph M. Becker" <cmbecker69@arcor.de> - 2018-09-05 12:41 +0200
          Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC bill <william@TechServSys.com> - 2018-09-05 07:34 -0400
            Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC "Christoph M. Becker" <cmbecker69@arcor.de> - 2018-09-05 14:15 +0200
              Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC bill <william@TechServSys.com> - 2018-09-07 14:09 -0400
          Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC Jerry Stuckle <jstucklex@attglobal.net> - 2018-09-05 11:26 -0400
            Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC bill <william@TechServSys.com> - 2018-09-08 06:50 -0400
        Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC Arno Welzel <usenet@arnowelzel.de> - 2018-09-10 10:04 +0200
          Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC Härra Ramob <hrramob@gmail.com> - 2022-01-02 03:47 -0800
  Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC "J.O. Aho" <user@example.net> - 2018-01-23 18:58 +0100
  Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC nandini1.besant@gmail.com - 2018-01-25 04:11 -0800
    Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC Jerry Stuckle <jstucklex@attglobal.net> - 2018-01-25 15:33 -0500
  Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC careenjoseph36@gmail.com - 2018-03-01 03:20 -0800
    Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC "J.O. Aho" <user@example.net> - 2018-03-01 20:35 +0100

csiph-web