RE: [PHP] encrypting /descrypting a password

My concern is: what if someone breaks into the database? he would see all the passwords unencrypted. it is safer to encrypt the passwords on their creation and encrypting inputted passwords on their submission - then match these. P.S: Tijmen, if you would look through archives you would find a hundred of threads and few thousands of emails with them about this issue. I am sure some GOOD ideas were thrown there. look at: http://marc.theaimsgroup.com/?l=php-general Cheers, Maxim Maletsky. -----Original Message----- From: Joe Stump [mailto:joe@earth.care2.com] Sent: Friday, November 24, 2000 7:03 PM To: Mattias Segerdahl Cc: php-general@lists.php.net Subject: Re: [PHP] encrypting /descrypting a password I've seen it done with md5() - just make a key, say '5643225', then take a person's password and concatonate the two - like this: $encrypted_pass = md5($password.$key); Then when someone logs in grab the password from the DB and put your key on the end, and do the same with the entered password - if they equal each other then they are good to go. This lets you store an encrypted password in a cookie easily. --JOe On Fri, Nov 24, 2000 at 10:55:18AM +0100, Mattias Segerdahl wrote: > I'd say go with mysql's own password() method.. > > insert method: insert into users (id,username,password) > values('$id','$username',password('$password')); > select method: select id,username,password from users where username = > $username and password = password('$password'); > > // Mattias aka efnet's #php bad2da > > ----- Original Message ----- > From: <hennink@patrijs.max.nl> > To: <php-general@lists.php.net> > Sent: Friday, November 24, 2000 10:59 AM > Subject: [PHP] encrypting /descrypting a password > > > > Hi, > > > > I'm working on a authorizationenvironment and now I've to decide how to > > store my password's in Mysql. > > What would be the safiest solution? > > What if I choose des to encrypt the given password in de dbase? > > How could I check that when a user is logging in that the given password > > is > > the same as the one that is encrypted because there is no decrypt to see > > if the passwords match. > > > > With regards, > > > > Tijmen > > > > -- > > Customer: I'm running Windows '98 > > Tech: Yes. > > Customer: My computer isn't working now. > > Tech: Yes, you said that. > > > > > > -- > > PHP General Mailing List (http://www.php.net/) > > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > > For additional commands, e-mail: php-general-help@lists.php.net > > To contact the list administrators, e-mail: php-list-admin@lists.php.net > > > > > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net ============================================================================ ==== = Joe Stump joestump98@yahoo.com http://www.miester.org = ============================================================================ ==== Need a programmer? http://www.google.com/search?q=joe+stump+resume -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net For additional commands, e-mail: php-general-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net