note 42792 added to function.crypt

Well, fixed that problem, and I'm kicking myself for it, so here's a warning: if you're storing passwords as a varchar column in a MySQL database, check the length of an encrypted password using something like: <?php echo strlen(crypt("blah")); ?> Make sure the column is at least that wide! If you've already made the mistake, the quick-and-dirty way to fix it is to write yourself a simple query that does a mass reset of passwords (ONLY do this if you're working with test accounts, your own trivial information, etc.): <?php mysql_query("update users set password='" . crypt("oogabooga") . "'"); ?> The slow-and-clean way is to write a form where users can input their logins and passwords and have the latter re-entered into the database. (The users will certainly thank you for it.) Here's how to process the input from the form: <?php $result=mysql_query("select password from users where login='" . $_POST['login'] . "'"); $row=mysql_fetch_array($result, MYSQL_ASSOC); if(substr(crypt($_POST['password'], $row['password']), 0, strlen($row['password']))==$row['password']){ mysql_query("update users set password='" . $_POST['password'] . "' where login='" . $_POST['login'] . "'"); } ?> Here's the same thing broken down a bit more: <?php // From the user: $login=$_POST['login']; $input_pass=$_POST['password']; // Pulling out the poorly formed password. $result=mysql_query("select password from users where login='" . $login . "'"); $row=mysql_fetch_array($result, MYSQL_ASSOC); $cropped_encrypted_file_pass=$row['password']; // Encrypting the input password using the file password as a salt (which works even though it's poorly formed). $encrypted_input_pass=crypt($input_pass, $cropped_encrypted_file_pass); // Getting the length of the file password. $file_pass_length=strlen($cropped_encrypted_file_pass); // Cropping the input password to match the length of the file password, so the comparison will be valid. $cropped_encrypted_input_pass=substr($encrypted_input_pass, 0, $file_pass_length); // Testing the password and re-inserting the good one into the database. if($cropped_encrypted_input_pass==$cropped_encrypted_file_pass){ mysql_query("update users set password='" . $encrypted_input_pass . "' where login='" . $login . "'"); } ?> Figures. I'm lazy enough to do it the easy way on my own page, but for you guys I'll write out the good way. ---- Manual Page -- http://www.php.net/manual/en/function.crypt.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+42792 Delete -- http://master.php.net/manage/user-notes.php?action=delete+42792&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+42792&report=yes Search -- http://master.php.net/manage/user-notes.php