note 100769 deleted from function.crypt by joey

Note Submitter: fmaz008 at gmail dot com ---- It seem that this function has the same security problem as the LM encryption in windows XP where you only have to crack the first 8 characters. Some comment have mentionned it already, but here a really clear example that illustrate the situation: <?php $user = 'username'; $pass = 'thisismylongpassword'; for($i=1;$i<=strlen($pass);$i++) echo crypt(substr($pass, 0, $i), $user) . ' - ' . substr($pass, 0, $i) . '<br>'; ?> Here's the result: usWV5iQ2lF6wU - t usFyQOx58wzek - th useskTjnZElpE - thi usJhkSkD0WfCI - this usHhCeL6bIVpY - thisi usBZjSWdjcz9M - thisis usp4N0rk4kv7w - thisism usKlq9t5QnOQo - thisismy usKlq9t5QnOQo - thisismyl usKlq9t5QnOQo - thisismylo usKlq9t5QnOQo - thisismylon usKlq9t5QnOQo - thisismylong usKlq9t5QnOQo - thisismylongp usKlq9t5QnOQo - thisismylongpa usKlq9t5QnOQo - thisismylongpas usKlq9t5QnOQo - thisismylongpass usKlq9t5QnOQo - thisismylongpassw usKlq9t5QnOQo - thisismylongpasswo usKlq9t5QnOQo - thisismylongpasswor usKlq9t5QnOQo - thisismylongpassword So basicaly, the password get truncated here: thisismy<here>longpassword Everything over 8 characters is dismissed.