1

I am at a loss for what is happening here -- because depending on which user I check, there isn't necessarily something wrong at all. Here's the database in question's structure:

userID       password      salt
VARCHAR(7)   VARCHAR(64)   VARCHAR(64)

Note: password and salt are sha256 hashes.

And relevant code (all data is transmitted over SSL):

$pass     = $_POST['pass'];
$user     = $_POST['user'];

$query    = 'SELECT password, salt FROM `Passwords` WHERE userID="'.$user.'";';
$result   = mysql_query($query);

$passHash = mysql_result($result,0,"password");
$salt     = mysql_result($result,0,"salt");

$pass     = hash("sha256",$salt.$pass);

if($pass==$passHash) {/*Allow Login*/}

Not all users have chosen a password, and my organization has historically used ZIP codes (I know...) in place of a proper password, so the code does make some exceptions for that, but all of those users can all login just fine. It's (only some) members with passwords that can't login, because $salt is returning blank for some reason (but I'm not getting any MySQL errors, either). I have checked the database through phpMyAdmin while running debug attempts, but there's no obvious error.

Any idea why it's coming up blank for some users but not others? Is this a PHP problem, a MySQL problem, or an I'm-a-blind-idiot problem?

Julian
  • 71
  • 6
  • 2
    What will happen is someones name is `h" OR (DELETE FROM Passwords) OR 1 !="` ? <<< Escape your data, or (a lot better): use prepared statements... Saves you a lot of headaches. – Green Black Feb 28 '13 at 16:50
  • *Obligatory:* The `mysql_*` functions will be [deprecated in PHP 5.5](http://php.net/manual/en/faq.databases.php#faq.databases.mysql.deprecated). It is not recommended for writing new code as it will be removed in the future. Instead, either the [MySQLi](http://php.net/manual/en/book.mysqli.php) or [PDO](http://php.net/manual/en/book.pdo.php) and [be a better PHP Developer](http://jason.pureconcepts.net/2012/08/better-php-developer/). – Jason McCreary Feb 28 '13 at 16:54
  • I do have a basic sanitizing script in place, just to make sure that the `userID` is one-letter-six-number. The other fields are all hashed, as well. My confusion is that the `$salt` value **is** working for some users with passwords, but not all of them. – Julian Feb 28 '13 at 17:18

0 Answers0