I use the MySQL password($plainText) function. It uses one-way encryption. When saving the password, I pass it through this function. when checking what the user submits, I pass their plain-text through the same function and compare the encrypted results.
SELECT loginid FROM login WHERE loginname = '$loginname' AND password = password('$pass')
Because encrypting the same text with the password() function will always return the same result, you can compare encrypted result against encrypted result without ever really "knowing" what the password is. It doesn't have to be saved anywhere in the system: not in the database, not in the cookie.
Hope that helps.
I have found the PHP function called MD5 that encripts strings and creates the hash string that can be used later to de-encrypt.
Please see the implementation:
// Create an activation hash with the name, password and current time $activation_hash = md5($username . $password . time());
// Insert query (has to be adapted for php)
INSERT INTO login (username,password,activation_hash)
VALUES ('$username', MD5('$password') , '$activation_hash')
// Select query (has to be adapted for php)
SELECT loginid, password, activation_hash
FROM login
WHERE username = '$username'
//Check if the password entered is correct if(md5($password) == $activation_hash) { echo"User Authenticated Correctly"; }
Note: I am currently implementing this code, it could have some bugs but this is the idea.
See the snippet below. Stored Routines were introduced in MySQL 5.0, so you need that version or later. The snippet shows the "extra stuff" you need to create the procedure prc_hereiam. Additional input parameters would be separated by commas.
DROP PROCEDURE if EXISTS `prc_hereiam`;
delimiter //
CREATE PROCEDURE prc_hereiam (varPHPSessID VARCHAR(32)) BEGIN
-SV
Keep doing the good work!
I am implementing your code and I would know if you could show some information about how you encrypt the password to the database?
My email address is zsnoop@gmail.com
Thanks and best regards
Zs
INSERT INTO login (loginname,password)
VALUES ('$loginname',password('$pass'))
SELECT loginid
FROM login
WHERE loginname = '$loginname'
AND password = password('$pass')
Please see the implementation:
$activation_hash = md5( $username . $password . time() );
// Insert query (has to be adapted for php)
INSERT INTO login (username,password,activation_hash)
VALUES ('$username', MD5('$password') , '$activation_hash' )
// Select query (has to be adapted for php)
SELECT loginid, password, activation_hash
FROM login
WHERE username = '$username'
//Check if the password entered is correct
if (md5($password) == $activation_hash)
{
echo "User Authenticated Correctly";
}
what arguments the code need?
Im realy new in stored procedured.
Stored Routines were introduced in MySQL 5.0, so you need that version or later. The snippet shows the "extra stuff" you need to create the procedure prc_hereiam.
Additional input parameters would be separated by commas.
DROP PROCEDURE if EXISTS `prc_hereiam`;
delimiter //
CREATE PROCEDURE prc_hereiam (varPHPSessID VARCHAR(32))
BEGIN
DECLARE outLoginId INT;
DECLARE outMemberLevel INT;
... rest of the code goes here
COMMIT;
END;
//
delimiter ;
CREATE PROCEDURE prc_procedurename (inputValue INT, inputAnother INT)