57

I'm using sha256 to encrypt the password. I can save the sha256 encrypted password in mysql. But i can't login with the same clause.

Insert code:

<?php
error_reporting(E_ALL ^ E_NOTICE);
$username = $_POST['uusername'];
$passcode = $_POST['ppasscode'];
$userflag = $_POST['uuserflag'];
//$passcodeen = hash('sha256',$passcode);
$passcodeen = hash('sha256', (get_magic_quotes_gpc() ? stripslashes($ppasscode) : $ppasscode));
$conn = mysql_connect("localhost","charles","charles") or die("connection failed with DB:".mysql_error());
mysql_select_db("sessiondb");
$query = "INSERT INTO users(username,passcode,userflag) values('$username','$passcodeen','$userflag')";

Select code:

<?php 
error_reporting(E_ALL ^ E_NOTICE);

    @mysql_connect("localhost","charles","charles") or die("Connection failed".mysql_error());
    @mysql_select_db("sessiondb") or die("Database doesn't exist".mysql_error());
    //get user input
    $username = $_POST['username'];
    $ppasscode = $_POST['ppasscode'];
    //$passcodeen = hash('sha256', $ppasscode);
    $passcodeen = hash('sha256', (get_magic_quotes_gpc() ? stripslashes($ppasscode) : $ppasscode));
    //get session value from mysql
    $query = @mysql_query("select username, userflag from users where username ='$username' and passcode = '$passcodeen'") or die("Query execution failed".mysql_error());

Is there something wrong? I'm very confused. Thanks.

SUN Jiangong
  • 5,242
  • 16
  • 57
  • 76
  • 2
    Are you using a VARCHAR field to store the password? Because the max size on varchars is 255 characters... – davethegr8 Nov 17 '09 at 23:02
  • Can you post a sample of the hash as its stored in the database versus what it looks like in the code? – Noah Goodrich Nov 17 '09 at 23:02
  • 1
    For sha256, you need a VARCHAR of at least 64 characters. – Percutio Nov 17 '09 at 23:04
  • @davethegr8, yes, i use varchar(255), is it right? – SUN Jiangong Nov 17 '09 at 23:05
  • @Noah Goodrich, the value stored in mysql is:8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918 – SUN Jiangong Nov 17 '09 at 23:09
  • @jp, yes, i think it's enough with my varchar type. – SUN Jiangong Nov 17 '09 at 23:09
  • @garcon1986 - My first guess is that the two hash values are different. You only posted one. So either the problem lies in the hash value going into the database, once it gets stored, or with the hash value that you're generating on login. – Noah Goodrich Nov 17 '09 at 23:23
  • 1
    Just to address some misconceptions here, @davethegr8 -- in the last several versions of MySQL, varchar fields are basically text fields, and are **NOT** limited to 255 chars anymore. And, @jp and @garcon: SHA256 is **always** 64 chars, just use column type of `CHAR(64)` and skip the overhead. – Dereleased Nov 17 '09 at 23:25
  • 2
    check to see if your code is being hit by magic quotes, something like this: `$passcodeen = hash('sha256', (get_magic_quotes_gpc() ? stripslashes($ppasscode) : $ppasscode));` – Dereleased Nov 17 '09 at 23:27
  • @Noah Goodrich, Yes but i use the same username and password when creating and selecting in mysql. And it shouldn't have the problem. – SUN Jiangong Nov 17 '09 at 23:27
  • @garcon, I believe Noah means that something is going wrong on one of the steps. Please post the SQL strings for each query so we can see. – Dereleased Nov 17 '09 at 23:30
  • @dereleased, Thanks, i don't know how it works, but i does works with the code. Can you explain it specifically? Thanks very much. – SUN Jiangong Nov 17 '09 at 23:31
  • @dereleased, I have posted all the useful code. – SUN Jiangong Nov 17 '09 at 23:44
  • `sha256` is a hashing algorithm, not encryption – mrid Feb 27 '19 at 07:36

5 Answers5

84

Could this be a typo? (two Ps in ppasscode, intended?)

$_POST['ppasscode'];

I would make sure and do:

print_r($_POST);

and make sure the data is accurate there, and then echo out what it should look like:

echo hash('sha256', $_POST['ppasscode']);

Compare this output to what you have in the database (manually). By doing this you're exploring your possible points of failure:

  1. Getting password from form
  2. hashing the password
  3. stored password
  4. comparison of the two.
Jeremy Morgan
  • 3,314
  • 23
  • 23
12

First of all, sha256 is a hashing algorithm, not a type of encryption. An encryption would require having a way to decrypt the information back to its original value (collisions aside).

Looking at your code, it seems it should work if you are providing the correct parameter.

  • Try using a literal string in your code first, and verify its validity instead of using the $_POST[] variable

  • Try moving the comparison from the database query to the code (get the hash for the given user and compare to the hash you have just calculated)

But most importantly before deploying this in any kind of public fashion, please remember to sanitize your inputs. Don't allow arbitrary SQL to be insert into the queries. The best idea here would be to use parameterized queries.

Yannick Motton
  • 34,761
  • 4
  • 39
  • 55
  • 1
    +1 for advice on input validation. Parameterized queries provide a great deal of control for very little extra coding. – Jeremy Morgan Nov 17 '09 at 23:38
3

The first thing is to make a comparison of functions of SHA and opt for the safest algorithm that supports your programming language (PHP).

Then you can chew the official documentation to implement the hash() function that receives as argument the hashing algorithm you have chosen and the raw password.

sha256 => 64 bits sha384 => 96 bits sha512 => 128 bits

The more secure the hashing algorithm is, the higher the cost in terms of hashing and time to recover the original value from the server side.

$hashedPassword = hash('sha256', $password);
Braian Coronel
  • 22,105
  • 4
  • 57
  • 62
2

You should use Adaptive hashing like http://en.wikipedia.org/wiki/Bcrypt for securing passwords

Edwin M
  • 351
  • 3
  • 4
1

A way better solution is to just use the excelent compatibility script from Anthony Ferrara:

https://github.com/ircmaxell/password_compat

Please, and also, when checking the password, always add a way (preferibly async, so it doesn't impact the check process for timming attacks) to update the hash if needed.

Luis Ferro
  • 95
  • 2