note 42792 rejected from function.crypt by betz
| From: | betz@php.net | Date: | Sat, 29 May 2004 15:14:37 +0000 |
| Subject: | note 42792 rejected from function.crypt by betz | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-70278@lists.php.net to get a copy of this message | ||
Note Submitter: relsqui@armory.com
----
Well, fixed that problem, and I'm kicking myself for it, so here's a warning: if
you're storing passwords as a varchar column in a MySQL database, check the length of an
encrypted password using something like:
<?php echo strlen(crypt("blah")); ?>
Make sure the column is at least that wide!
If you've already made the mistake, the quick-and-dirty way to fix it is to write yourself a
simple query that does a mass reset of passwords (ONLY do this if you're working with test
accounts, your own trivial information, etc.):
<?php mysql_query("update users set password='" . crypt("oogabooga") .
"'"); ?>
The slow-and-clean way is to write a form where users can input their logins and passwords and have
the latter re-entered into the database. (The users will certainly thank you for it.) Here's
how to process the input from the form:
<?php
$result=mysql_query("select password from users where login='" .
$_POST['login'] . "'");
$row=mysql_fetch_array($result, MYSQL_ASSOC);
if(substr(crypt($_POST['password'], $row['password']), 0,
strlen($row['password']))==$row['password']){
mysql_query("update users set password='" . $_POST['password'] .
"' where login='" . $_POST['login'] . "'");
}
?>
Here's the same thing broken down a bit more:
<?php
// From the user:
$login=$_POST['login'];
$input_pass=$_POST['password'];
// Pulling out the poorly formed password.
$result=mysql_query("select password from users where login='" . $login .
"'");
$row=mysql_fetch_array($result, MYSQL_ASSOC);
$cropped_encrypted_file_pass=$row['password'];
// Encrypting the input password using the file password as a salt (which works even though
it's poorly formed).
$encrypted_input_pass=crypt($input_pass, $cropped_encrypted_file_pass);
// Getting the length of the file password.
$file_pass_length=strlen($cropped_encrypted_file_pass);
// Cropping the input password to match the length of the file password, so the comparison will be
valid.
$cropped_encrypted_input_pass=substr($encrypted_input_pass, 0, $file_pass_length);
// Testing the password and re-inserting the good one into the database.
if($cropped_encrypted_input_pass==$cropped_encrypted_file_pass){
mysql_query("update users set password='" . $encrypted_input_pass . "'
where login='" . $login . "'");
}
?>
Figures. I'm lazy enough to do it the easy way on my own page, but for you guys I'll write
out the good way.