note 47761 deleted from function.crypt by joey

Note Submitter: genius at clan-aftershock dot com ---- I discovered in the script stated before, when using a salt string the passwords length cannot be longer than 8 characters. However, when not using a salt string, it can exceded that limit. Modified Example from athony, not using the salt. <?php $password = "qwertyuiopasdfghjkl"; // Not using any salts $encrypted = crypt($password); // Now do the comparison $shortPass = substr($password, 0, 8); if (crypt( $shortPass, $encrypted ) == $encrypted ) echo "The passwords match"; else echo "The passwords do not match"; ?> This will print: "The passwords do not match" The check for password would still work if it was correct. Just by shortening the password string to eight, or extending the substr, or decalring the shortpass the same as the pass, it would be: "The passwords do match" So the eight letter limit only works when using a salt.