Re: encrypting /descrypting a password

Addressed to: <hennink@patrijs.max.nl> php-general@lists.php.net ** Reply to note from <hennink@patrijs.max.nl> Fri, 24 Nov 2000 11:20:05 +0100 (CET) > > OK, > > but what would be the safiest solution??? MD5 , DES of mysqls password?? > Never keep the plaintext password in the database at all. Why do you need to decrypt the password. You only need to see if it matches. Keeping the plaintext password around makes them easy to steal. If someone loses thier password, send them a new one. The MySQL PASSWORD() function encrypts the password similar to crypt() but it uses a different algorithm, and is not compatible. To see if the username/password is valid: $Query = "SELECT UserName, other, user, data ". "FROM Users " . "WHERE UserName = '$UserName' ". "AND PASSWORD( '$Password' ) = UserPass "; If you get any result back (mysql_num_rows( $Result ) > 0) then it is a valid user. If the username or password dont match Num Rows will be 0. You can pack other info about the user in the Users table and have it returned with very little overhead about the user validation. To store the username and password: $Query = "INSERT INTO Users SET " . " UserName = '$UserName', " . " Password = PASSWORD( '$Password' ) "; Someone mentioned that using PASSWORD() leaves unencrypted passwords in the database. That is not correct. The password value is encrypted one way. Rick Widmer Internet Marketing Specialists www.developersdesk.com When all you have is a hammer, everything looks like a nail.