Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #17667 > unrolled thread

PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC

Back to article view | Back to comp.lang.php

Contents

  PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC Timothy Steele <steeletimothy2000@gmail.com> - 2018-01-23 01:26 -0800
    Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC Jerry Stuckle <jstucklex@attglobal.net> - 2018-01-23 08:01 -0500
      Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC "J.O. Aho" <user@example.net> - 2018-01-23 18:59 +0100
      Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC Arno Welzel <usenet@arnowelzel.de> - 2018-09-05 09:37 +0200
        Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC tony@mountifield.org (Tony Mountifield) - 2018-09-05 10:19 +0000
          Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC "Christoph M. Becker" <cmbecker69@arcor.de> - 2018-09-05 12:41 +0200
            Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC bill <william@TechServSys.com> - 2018-09-05 07:34 -0400
              Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC "Christoph M. Becker" <cmbecker69@arcor.de> - 2018-09-05 14:15 +0200
                Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC bill <william@TechServSys.com> - 2018-09-07 14:09 -0400
            Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC Jerry Stuckle <jstucklex@attglobal.net> - 2018-09-05 11:26 -0400
              Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC bill <william@TechServSys.com> - 2018-09-08 06:50 -0400
          Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC Arno Welzel <usenet@arnowelzel.de> - 2018-09-10 10:04 +0200
            Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC Härra Ramob <hrramob@gmail.com> - 2022-01-02 03:47 -0800
    Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC "J.O. Aho" <user@example.net> - 2018-01-23 18:58 +0100
    Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC nandini1.besant@gmail.com - 2018-01-25 04:11 -0800
      Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC Jerry Stuckle <jstucklex@attglobal.net> - 2018-01-25 15:33 -0500
    Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC careenjoseph36@gmail.com - 2018-03-01 03:20 -0800
      Re: PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC "J.O. Aho" <user@example.net> - 2018-03-01 20:35 +0100

#17667 — PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC

Please i need help i have a voting system which allow me to add user as admin. in the process of adding the user i use a salt password hashing technic and is work perfectly that is when i what to add a user. The problem is that the user can not login and i have try but no way for me. The codes pasted below.

****first if the codes that allow me to add user to the tabase**** add_user.php

<?php  
 global $db;
// require("../config/db.php");
 global  $error1,  $error2, $error3, $error4;
$full_name = $username = $password = "";


if(isset($_POST['submit'])){
    $username = $_POST['username'];
    $ad_password = $_POST['password'];
    $full_name = $_POST['full_name'];

    $sql_query = mysqli_query($db, "SELECT username FROM admin WHERE username = '{$username}' ");
    $count = mysqli_num_rows($sql_query);

    $sql_salt = mysqli_query($db, "SELECT randSaltPass FROM admin");
    $row = mysqli_fetch_array($sql_salt);
    $salt = $row['randSaltPass'];        
    $password = crypt($ad_password, $salt);

    if(!empty($username) && !empty($ad_password) && !empty($full_name)){

        if($count > 0){
            $error1 = "<div class='alert alert-danger'>
                  <a href='#' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
                  Username  Already Exists.
                </div>";
        }else{

         $u_name     = mysqli_real_escape_string($db, $username);
         $pass_word  = mysqli_real_escape_string($db, $ad_password);
         $admin_name     = mysqli_real_escape_string($db, $full_name);

          if(!preg_match('/^[a-zA-Z]*$/', $u_name)){

             $error2 ="<div class='alert alert-danger'>
              <a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
                   Only Leters are Allowed  For Username.
             </div>";
          }
          if(!preg_match('/^[a-zA-Z]*$/', $admin_name)){
             $error3 ="<div class='alert alert-danger'>
              <a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
                   Only Leters are Allowed  For Fullname.
             </div>";
          }

          if(!preg_match('/^\S*(?=\S{7,15})(?=\S*[a-z])(?=\S*[A-Z])(?=\S*[\d])\S*$/', $pass_word)){
            $error4 ="<div class='alert alert-danger'>
              <a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
                  Password Must Be Between 7 and 15 Characters and Must Contain At Least One Lowercase Letter one uppercase Letter and One Digit.
             </div>";
          }


          if((preg_match('/^[a-zA-Z]*$/', $u_name)) && (preg_match('/^[a-zA-Z]*$/', $admin_name)) && (preg_match('/^\S*(?=\S{7,15})(?=\S*[a-z])(?=\S*[A-Z])(?=\S*[\d])\S*$/', $pass_word))){


             $sql = "INSERT INTO admin(username, password, admin_name) VALUES('{$u_name}', '{$password}', '{$admin_name}' )";

             $query = mysqli_query($db, $sql);

             if(!$query){
                die("QUERY FAILED " . mysqli_error($db));
             }

          }


        }

    }else{

        if(empty($username)){
            $error2="<div class='alert alert-danger'>
          <a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
               Username Can Be Empty.
           </div>";
        }
        if(empty($full_name)){
            $error3="<div class='alert alert-danger'>
          <a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
               Fullname Can Be Empty.
           </div>";
        }
        if(empty($password)){
            $error4="<div class='alert alert-danger'>
          <a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
                Password Can Be Empty.
           </div>";
        }

    }

}



 ?>


Second is the code that allow user to login but the problem is i do not Know where i will hash so that user will be able to login

Admin_login.php




class Admin_Login
{
    private $_username;
    private $_password;

    public function __construct($c_username, $c_password) {
        $this->_username = $c_username;
        $this->_password = md5($c_password);

        //  $sql_salt = mysqli_query($db, "SELECT randSaltPass FROM admin");
        // $row = mysqli_fetch_array($sql_salt);
        // $salt = $row['randSaltPass'];        
        // $password = crypt($db, $salt);
    }

    public function AdminLogin() {
        global $db;

        //Start session
        session_start();

        //Array to validate errors
        $error_msg_array = array();

        //Error messages
        $error_msg = FALSE;

        if($this->_username == "") {
            $error_msg_array[] = "Please input your username";
            $error_msg = TRUE;
        }

        if($this->_password == "") {
            $error_msg_array[] = "Please input your password";
            $error_msg = TRUE;
        }

        if($error_msg) {
            $_SESSION['ERROR_MSG_ARR'] = $error_msg_array;
            header("location: http://localhost/voting_system/sandbox/index.php");
            exit();
        }

        $sql = "SELECT * FROM admin WHERE username = ? AND password = ? LIMIT 1";
        if(!$stmt = $db->prepare($sql)) {
            echo $stmt->error;
        } else {
            $stmt->bind_param("ss", $this->_username, $this->_password);
            $stmt->execute();
            $result = $stmt->get_result();
        }

        if($result->num_rows > 0) {
            //Login successful
            $row = $result->fetch_assoc();

            //Create session
            session_regenerate_id();
            $_SESSION['ADMIN_ID']   = $row["id"];
            $_SESSION['ADMIN_NAME'] = $row["name"];
            session_write_close();

            header("location: http://localhost/voting_system/sandbox/admin_page.php");

        } else {
            //Login failed
            $error_msg_array[] = "The username and password you entered is incorrect.";
            $error_msg = TRUE;

            if($error_msg) {
                $_SESSION['ERROR_MSG_ARR'] = $error_msg_array;
                header("location: http://localhost/voting_system/sandbox/index.php");
                exit();
            }
            $stmt->free_result();
        }
        $result->free();
        return $result;
    }
}




login.php


<?php
//Include database connection
require("../../config/db.php");

//Include class Admin_Login
require("../classes/Admin_Login.php");

if(isset($_POST['submit'])) {

    //Create variable to store post array values
    $username = trim($_POST['username']);
    $password = trim($_POST['password']);

    $adminLogin = new Admin_Login($username, $password);
    $rtnAdminLogin = $adminLogin->AdminLogin();

}

[toc] | [next] | [standalone]

#17671

On 1/23/2018 4:26 AM, Timothy Steele wrote:
> Please i need help i have a voting system which allow me to add user as admin. in the process of adding the user i use a salt password hashing technic and is work perfectly that is when i what to add a user. The problem is that the user can not login and i have try but no way for me. The codes pasted below.
> 
<Snip code>

First of all, you are storing the password in your database in plain 
text.  This is very insecure; rather store it encrypted.  As you have 
it, you will never get a match between the plain text password in your 
database and an encrypted one from the user.

When you have problems like this, it's often handy to echo the 
appropriate values to the screen for debugging.  Of course you only do 
this on your development system, which is not accessible from the internet.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#17673

On 01/23/18 14:01, Jerry Stuckle wrote:
> On 1/23/2018 4:26 AM, Timothy Steele wrote:
>> Please i need help i have a voting system which allow me to add user
>> as admin. in the process of adding the user i use a salt password
>> hashing technic and is work perfectly that is when i what to add a
>> user. The problem is that the user can not login and i have try but no
>> way for me. The codes pasted below.
>>
> <Snip code>
> 
> First of all, you are storing the password in your database in plain
> text.  This is very insecure; rather store it encrypted.  As you have
> it, you will never get a match between the plain text password in your
> database and an encrypted one from the user.
> 
> When you have problems like this, it's often handy to echo the
> appropriate values to the screen for debugging.  Of course you only do
> this on your development system, which is not accessible from the internet.

The code is bad, but the password ain't stored in plain text.

-- 

 //Aho

[toc] | [prev] | [next] | [standalone]

#17793

Jerry Stuckle:

[...]
> When you have problems like this, it's often handy to echo the 
> appropriate values to the screen for debugging.  Of course you only do 
> this on your development system, which is not accessible from the internet.

Even better is to use a debugger.


-- 
Arno Welzel
https://arnowelzel.de
https://de-rec-fahrrad.de
http://fahrradzukunft.de

[toc] | [prev] | [next] | [standalone]

#17795

In article <fv9fe0Fca6oU4@mid.individual.net>,
Arno Welzel  <usenet@arnowelzel.de> wrote:
> Jerry Stuckle:
> 
> [...]
> > When you have problems like this, it's often handy to echo the 
> > appropriate values to the screen for debugging.  Of course you only do 
> > this on your development system, which is not accessible from the internet.
> 
> Even better is to use a debugger.

What debuggers are available for PHP running on a LAMP stack?

Cheers
Tony
-- 
Tony Mountifield
Work: tony@softins.co.uk - http://www.softins.co.uk
Play: tony@mountifield.org - http://tony.mountifield.org

[toc] | [prev] | [next] | [standalone]

#17796

On 05.09.2018 at 12:19, Tony Mountifield wrote:

> In article <fv9fe0Fca6oU4@mid.individual.net>,
> Arno Welzel  <usenet@arnowelzel.de> wrote:
>
>> Jerry Stuckle:
>>
>> [...]
>>> When you have problems like this, it's often handy to echo the 
>>> appropriate values to the screen for debugging.  Of course you only do 
>>> this on your development system, which is not accessible from the internet.
>>
>> Even better is to use a debugger.
> 
> What debuggers are available for PHP running on a LAMP stack?

<https://xdebug.org/> is generally recommendable.  You also may want to
have a look at <http://php.net/manual/en/book.phpdbg.php>.

-- 
Christoph M. Becker

[toc] | [prev] | [next] | [standalone]

#17797

On 9/5/2018 6:41 AM, Christoph M. Becker wrote:
> On 05.09.2018 at 12:19, Tony Mountifield wrote:
> 
>> In article <fv9fe0Fca6oU4@mid.individual.net>,
>> Arno Welzel  <usenet@arnowelzel.de> wrote:
>>
>>> Jerry Stuckle:
>>>
>>> [...]
>>>> When you have problems like this, it's often handy to echo the
>>>> appropriate values to the screen for debugging.  Of course you only do
>>>> this on your development system, which is not accessible from the internet.
>>>
>>> Even better is to use a debugger.
>>
>> What debuggers are available for PHP running on a LAMP stack?
> 
> <https://xdebug.org/> is generally recommendable.  You also may want to
> have a look at <http://php.net/manual/en/book.phpdbg.php>.
> 
does phpdbg need to be  included via php.ini or ??
The manual on installation is a bit terse.

bill

[toc] | [prev] | [next] | [standalone]

#17798

On 05.09.2018 at 13:34, bill wrote:

> On 9/5/2018 6:41 AM, Christoph M. Becker wrote:
>
>> On 05.09.2018 at 12:19, Tony Mountifield wrote:
>>
>>> What debuggers are available for PHP running on a LAMP stack?
>>
>> <https://xdebug.org/> is generally recommendable.  You also may want to
>> have a look at <http://php.net/manual/en/book.phpdbg.php>.
>>
> does phpdbg need to be  included via php.ini or ??
> The manual on installation is a bit terse.

The manual is still very incomplete.
<https://phpdbg.room11.org/introduction.html> should descibe some
missing details.

-- 
Christoph M. Becker

[toc] | [prev] | [next] | [standalone]

#17800

On 9/5/2018 8:15 AM, Christoph M. Becker wrote:
> On 05.09.2018 at 13:34, bill wrote:
> 
>> On 9/5/2018 6:41 AM, Christoph M. Becker wrote:
>>
>>> On 05.09.2018 at 12:19, Tony Mountifield wrote:
>>>
>>>> What debuggers are available for PHP running on a LAMP stack?
>>>
>>> <https://xdebug.org/> is generally recommendable.  You also may want to
>>> have a look at <http://php.net/manual/en/book.phpdbg.php>.
>>>
>> does phpdbg need to be  included via php.ini or ??
>> The manual on installation is a bit terse.
> 
> The manual is still very incomplete.
> <https://phpdbg.room11.org/introduction.html> should descibe some
> missing details.
> 
Thank you very much
-bill

[toc] | [prev] | [next] | [standalone]

#17799

On 9/5/2018 6:41 AM, Christoph M. Becker wrote:
> On 05.09.2018 at 12:19, Tony Mountifield wrote:
> 
>> In article <fv9fe0Fca6oU4@mid.individual.net>,
>> Arno Welzel  <usenet@arnowelzel.de> wrote:
>>
>>> Jerry Stuckle:
>>>
>>> [...]
>>>> When you have problems like this, it's often handy to echo the
>>>> appropriate values to the screen for debugging.  Of course you only do
>>>> this on your development system, which is not accessible from the internet.
>>>
>>> Even better is to use a debugger.
>>
>> What debuggers are available for PHP running on a LAMP stack?
> 
> <https://xdebug.org/> is generally recommendable.  You also may want to
> have a look at <http://php.net/manual/en/book.phpdbg.php>.
> 

xdebug is not a debugger itself.  It is simply an interface into the PHP 
code.  You need an additional product such as Eclipse to debug the code. 
  And that can be difficult to set up the first time, especially if 
you're debugging a remote system (and if you are debugging a remote 
system you need the same source code on both your local and remote system).

This is why I suggested he simply echo the values to the screen.  It's 
quick and easy, especially for a beginner.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#17801

On 9/5/2018 11:26 AM, Jerry Stuckle wrote:
> On 9/5/2018 6:41 AM, Christoph M. Becker wrote:
>> On 05.09.2018 at 12:19, Tony Mountifield wrote:
>>
>>> In article <fv9fe0Fca6oU4@mid.individual.net>,
>>> Arno Welzel  <usenet@arnowelzel.de> wrote:
>>>
>>>> Jerry Stuckle:
>>>>
>>>> [...]
>>>>> When you have problems like this, it's often handy to echo the
>>>>> appropriate values to the screen for debugging.  Of course 
>>>>> you only do
>>>>> this on your development system, which is not accessible 
>>>>> from the internet.
>>>>
>>>> Even better is to use a debugger.
>>>
>>> What debuggers are available for PHP running on a LAMP stack?
>>
>> <https://xdebug.org/> is generally recommendable.  You also may 
>> want to
>> have a look at <http://php.net/manual/en/book.phpdbg.php>.
>>
> 
> xdebug is not a debugger itself.  It is simply an interface into 
> the PHP code.  You need an additional product such as Eclipse to 
> debug the code.  And that can be difficult to set up the first 
> time, especially if you're debugging a remote system (and if you 
> are debugging a remote system you need the same source code on 
> both your local and remote system).
> 
> This is why I suggested he simply echo the values to the screen.  
> It's quick and easy, especially for a beginner.
> 

AS I have done. I have a tiny library of routines to "pretty" 
show variables.

[toc] | [prev] | [next] | [standalone]

#17802

Tony Mountifield:

> In article <fv9fe0Fca6oU4@mid.individual.net>,
> Arno Welzel  <usenet@arnowelzel.de> wrote:
>> Jerry Stuckle:
>>
>> [...]
>>> When you have problems like this, it's often handy to echo the 
>>> appropriate values to the screen for debugging.  Of course you only do 
>>> this on your development system, which is not accessible from the internet.
>>
>> Even better is to use a debugger.
> 
> What debuggers are available for PHP running on a LAMP stack?

Visual Studio Code and XDebug:

<https://code.visualstudio.com>
<https://xdebug.org>

Yes, Visual Studio Code is by Microsoft - but it's Open Source and based
on Electron and can therefore be used with Windows, macOS and Linux.
There are also extensions for PHP debugging:

<https://code.visualstudio.com/docs/languages/php>


-- 
Arno Welzel
https://arnowelzel.de
https://de-rec-fahrrad.de
http://fahrradzukunft.de

[toc] | [prev] | [next] | [standalone]

#18833

Arno Welzel kirjutas Esmaspäev, 10. september 2018 kl 11:05:03 UTC+3:
> Tony Mountifield:
> > In article <fv9fe0...@mid.individual.net>, 
> > Arno Welzel <use...@arnowelzel.de> wrote: 
> >> Jerry Stuckle: 
> >> 
> >> [...] 
> >>> When you have problems like this, it's often handy to echo the 
> >>> appropriate values to the screen for debugging. Of course you only do 
> >>> this on your development system, which is not accessible from the internet. 
> >> 
> >> Even better is to use a debugger. 
> > 
> > What debuggers are available for PHP running on a LAMP stack?
> Visual Studio Code and XDebug: 
> 
> <https://code.visualstudio.com> 
> <https://xdebug.org> 
> 
> Yes, Visual Studio Code is by Microsoft - but it's Open Source and based 
> on Electron and can therefore be used with Windows, macOS and Linux. 
> There are also extensions for PHP debugging: 
> 
> <https://code.visualstudio.com/docs/languages/php>
> -- 
> Arno Welzel 
> https://arnowelzel.de 
> https://de-rec-fahrrad.de 
> http://fahrradzukunft.de

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

[toc] | [prev] | [next] | [standalone]

#17672

On 01/23/18 10:26, Timothy Steele wrote:
> Please i need help i have a voting system which allow me to add user as admin. in the process of adding the user i use a salt password hashing technic and is work perfectly that is when i what to add a user. The problem is that the user can not login and i have try but no way for me. The codes pasted below.
> 
> ****first if the codes that allow me to add user to the tabase**** add_user.php

I would recommend you do the hashing in the database layer. Then you
don't need to pull the salt to the php-layer.


> <?php  
>  global $db;
> // require("../config/db.php");
>  global  $error1,  $error2, $error3, $error4;
> $full_name = $username = $password = "";
> 
> 
> if(isset($_POST['submit'])){
>     $username = $_POST['username'];
>     $ad_password = $_POST['password'];
>     $full_name = $_POST['full_name'];
> 
>     $sql_query = mysqli_query($db, "SELECT username FROM admin WHERE username = '{$username}' ");
>     $count = mysqli_num_rows($sql_query);
> 
>     $sql_salt = mysqli_query($db, "SELECT randSaltPass FROM admin");
>     $row = mysqli_fetch_array($sql_salt);
>     $salt = $row['randSaltPass'];        
>     $password = crypt($ad_password, $salt);
> 
>     if(!empty($username) && !empty($ad_password) && !empty($full_name)){
> 
>         if($count > 0){
>             $error1 = "<div class='alert alert-danger'>
>                   <a href='#' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
>                   Username  Already Exists.
>                 </div>";
>         }else{
> 
>          $u_name     = mysqli_real_escape_string($db, $username);
>          $pass_word  = mysqli_real_escape_string($db, $ad_password);
What's the point of this? $pass_word is just used in a regex and you
don't need to mysql escape it when you don't use it in the SQL.


>          $admin_name     = mysqli_real_escape_string($db, $full_name);
> 
>           if(!preg_match('/^[a-zA-Z]*$/', $u_name)){
> 
>              $error2 ="<div class='alert alert-danger'>
>               <a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
>                    Only Leters are Allowed  For Username.
>              </div>";
>           }
>           if(!preg_match('/^[a-zA-Z]*$/', $admin_name)){
>              $error3 ="<div class='alert alert-danger'>
>               <a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
>                    Only Leters are Allowed  For Fullname.
>              </div>";
>           }
> 
>           if(!preg_match('/^\S*(?=\S{7,15})(?=\S*[a-z])(?=\S*[A-Z])(?=\S*[\d])\S*$/', $pass_word)){
>             $error4 ="<div class='alert alert-danger'>
>               <a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
>                   Password Must Be Between 7 and 15 Characters and Must Contain At Least One Lowercase Letter one uppercase Letter and One Digit.
>              </div>";
>           }
> 
> 
>           if((preg_match('/^[a-zA-Z]*$/', $u_name)) && (preg_match('/^[a-zA-Z]*$/', $admin_name)) && (preg_match('/^\S*(?=\S{7,15})(?=\S*[a-z])(?=\S*[A-Z])(?=\S*[\d])\S*$/', $pass_word))){
> 
> 
>              $sql = "INSERT INTO admin(username, password, admin_name) VALUES('{$u_name}', '{$password}', '{$admin_name}' )";
> 
>              $query = mysqli_query($db, $sql);
> 
>              if(!$query){
>                 die("QUERY FAILED " . mysqli_error($db));
>              }
> 
>           }
> 
> 
>         }
> 
>     }else{
> 
>         if(empty($username)){
>             $error2="<div class='alert alert-danger'>
>           <a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
>                Username Can Be Empty.
>            </div>";
>         }
>         if(empty($full_name)){
>             $error3="<div class='alert alert-danger'>
>           <a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
>                Fullname Can Be Empty.
>            </div>";
>         }
>         if(empty($password)){
>             $error4="<div class='alert alert-danger'>
>           <a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
>                 Password Can Be Empty.
>            </div>";
>         }
> 
>     }
> 
> }
> 
> 
> 
>  ?>
> 
> 
> Second is the code that allow user to login but the problem is i do not Know where i will hash so that user will be able to login
> 
> Admin_login.php
> 
> 
> 
> 
> class Admin_Login
> {
>     private $_username;
>     private $_password;
> 
>     public function __construct($c_username, $c_password) {
>         $this->_username = $c_username;
>         $this->_password = md5($c_password);

Password ain't salted, so you can't compare that to the result from
crypt() which could use something else than md5 (md5 ain't safe to use
for passwords, use at least sha2).
> 
>         //  $sql_salt = mysqli_query($db, "SELECT randSaltPass FROM admin");
>         // $row = mysqli_fetch_array($sql_salt);
>         // $salt = $row['randSaltPass'];        
>         // $password = crypt($db, $salt);
>     }
> 
>     public function AdminLogin() {
>         global $db;
> 
>         //Start session
>         session_start();
> 
>         //Array to validate errors
>         $error_msg_array = array();
> 
>         //Error messages
>         $error_msg = FALSE;
> 
>         if($this->_username == "") {
>             $error_msg_array[] = "Please input your username";
>             $error_msg = TRUE;
>         }
> 
>         if($this->_password == "") {
>             $error_msg_array[] = "Please input your password";
>             $error_msg = TRUE;
>         }
> 
>         if($error_msg) {
>             $_SESSION['ERROR_MSG_ARR'] = $error_msg_array;
>             header("location: http://localhost/voting_system/sandbox/index.php");
>             exit();
>         }
> 
>         $sql = "SELECT * FROM admin WHERE username = ? AND password = ? LIMIT 1";
>         if(!$stmt = $db->prepare($sql)) {
>             echo $stmt->error;
>         } else {
>             $stmt->bind_param("ss", $this->_username, $this->_password);
>             $stmt->execute();
>             $result = $stmt->get_result();
>         }
> 
>         if($result->num_rows > 0) {
>             //Login successful
>             $row = $result->fetch_assoc();
> 
>             //Create session
>             session_regenerate_id();
>             $_SESSION['ADMIN_ID']   = $row["id"];
>             $_SESSION['ADMIN_NAME'] = $row["name"];
>             session_write_close();
> 
>             header("location: http://localhost/voting_system/sandbox/admin_page.php");
> 
>         } else {
>             //Login failed
>             $error_msg_array[] = "The username and password you entered is incorrect.";
>             $error_msg = TRUE;
> 
>             if($error_msg) {
>                 $_SESSION['ERROR_MSG_ARR'] = $error_msg_array;
>                 header("location: http://localhost/voting_system/sandbox/index.php");
>                 exit();
>             }
>             $stmt->free_result();
>         }
>         $result->free();
>         return $result;
>     }
> }
> 
> 
> 
> 
> login.php
> 
> 
> <?php
> //Include database connection
> require("../../config/db.php");
> 
> //Include class Admin_Login
> require("../classes/Admin_Login.php");
> 
> if(isset($_POST['submit'])) {
> 
>     //Create variable to store post array values
>     $username = trim($_POST['username']);
>     $password = trim($_POST['password']);
quite bad if you have an ending/starting space in your password.

> 
>     $adminLogin = new Admin_Login($username, $password);
>     $rtnAdminLogin = $adminLogin->AdminLogin();
> 
> }
> 

-- 

 //Aho

[toc] | [prev] | [next] | [standalone]

#17674

Hash algorithms are one way functions. They turn any amount of data into a fixed-length "fingerprint" that cannot be reversed. They also have the property that if the input changes by even a tiny bit, the resulting hash is completely different (see the example above). This is great for protecting passwords, because we want to store passwords in a form that protects them even if the password file itself is compromised, but at the same time, we need to be able to verify that a user's password is correct.
https://www.besanttechnologies.com/training-courses/other-training-courses/digital-marketing-training-institute-in-chennai

[toc] | [prev] | [next] | [standalone]

#17675

On 1/25/2018 7:11 AM, nandini1.besant@gmail.com wrote:
> Hash algorithms are one way functions. They turn any amount of data into a fixed-length "fingerprint" that cannot be reversed. They also have the property that if the input changes by even a tiny bit, the resulting hash is completely different (see the example above). This is great for protecting passwords, because we want to store passwords in a form that protects them even if the password file itself is compromised, but at the same time, we need to be able to verify that a user's password is correct.
> https://www.besanttechnologies.com/training-courses/other-training-courses/digital-marketing-training-institute-in-chennai
> 

Go away, SPAMMER!

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#17695

There are a lot of conflicting ideas and misconceptions on how to do password hashing properly, probably due to the abundance of misinformation on the web. Password hashing is one of those things that's so simple, but yet so many people get wrong. With this page, I hope to explain not only the correct way to do it, but why it should be done that way.
http://www.trainingbangalore.in/hadoop-training-in-bangalore.html

[toc] | [prev] | [next] | [standalone]

#17696

On 03/01/18 12:20, careenjoseph36@gmail.com wrote:
> There are a lot of conflicting ideas and misconceptions on how to do password hashing properly, probably due to the abundance of misinformation on the web. Password hashing is one of those things that's so simple, but yet so many people get wrong. With this page, I hope to explain not only the correct way to do it, but why it should be done that way.
> http://www.indianspammer.example.net/some-third-grade-training-in-bangalore.html

Thanks for the utter crap from India, a good advice is to ignore sites
located in India or articles written by Indians and you have got rid of
70% of bad solutions.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.php

csiph-web