Re: encrypting /descrypting a password

Little mistake from me. I thought that when you're using DES you never get the same result when encrypting the same string because you're using a salt string. But it isn't my idea to store plain text in in mysql. Tijmen On Fri, 24 Nov 2000 php3@developersdesk.com wrote: > Addressed to: <hennink@patrijs.max.nl> > php-general@lists.php.net > > ** Reply to note from <hennink@patrijs.max.nl> Fri, 24 Nov 2000 11:20:05 +0100 (CET) > > > > OK, > > > > but what would be the safiest solution??? MD5 , DES of mysqls password?? > > > > Never keep the plaintext password in the database at all. > > > Why do you need to decrypt the password. You only need to see if it > matches. Keeping the plaintext password around makes them easy to steal. > If someone loses thier password, send them a new one. > > > The MySQL PASSWORD() function encrypts the password similar to crypt() but > it uses a different algorithm, and is not compatible. > > > To see if the username/password is valid: > > > $Query = "SELECT UserName, other, user, data ". > "FROM Users " . > "WHERE UserName = '$UserName' ". > "AND PASSWORD( '$Password' ) = UserPass "; > > > If you get any result back (mysql_num_rows( $Result ) > 0) then it is a > valid user. If the username or password dont match Num Rows will be 0. > You can pack other info about the user in the Users table and have it > returned with very little overhead about the user validation. > > > To store the username and password: > > > $Query = "INSERT INTO Users SET " . > " UserName = '$UserName', " . > " Password = PASSWORD( '$Password' ) "; > > > > Someone mentioned that using PASSWORD() leaves unencrypted passwords in the > database. That is not correct. The password value is encrypted one way. > > > > > Rick Widmer > Internet Marketing Specialists > www.developersdesk.com > > > When all you have is a hammer, > everything looks like a nail. > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net > > -- Customer: I'm running Windows '98 Tech: Yes. Customer: My computer isn't working now. Tech: Yes, you said that.