How to use multiple password in php? - php

Question

I have a password protected webpage with one password. But, I want to use multiple passwords on that webpage... I'm very new to PHP...
So, can anyone give me some advice on how to do this!
Thanks in Advance!
here is the code I'm using:
<?php
$password = "anything";
?>
on that code, I want to use "anything" & also use "mypass" as password same time!
I just use this code for multiplying the pass. but, won't work!
<?php
$password = "anything" + "mypass";
?>
& the full code is:
<?php
if (isset($_POST["password"]) && ($_POST["password"]=="$password")) {
?>
### anything to hide before password given!
<?php
}
else
{
if (isset($_POST['password']) || $password == "") {
print "<p align=\"center\"><font color=\"red\"><b>Wrong Password !!!</b><br>Please enter the correct Password</font></p>";}
print "<form method=\"post\"><p align=\"center\"><b>Please enter the Password</b><br/><br/>";
print "<b>Password </b><input class=\"box\" name=\"password\" type=\"password\" maxlength=\"10\"><input class=\"button\" value=\"Download\" type=\"submit\"></p></form>";
}
?>

Answer 1

use an array of passwords. btw
== and === is vulnerable to timing attacks, use hash_equals instead, but even hash_equals is vulnerable to timing attacks if the length of the 2 inputs is not equal, so hash the passwords before comparing them, to pad the length. something like
$authed=false;
if (isset($_POST["password"])){
$passwords=array('pass1','pass2','pass3');
$u=hash('md5',(string)$_POST["password"],true); // using a weak (and fast) CS hash is not a problem, because we're only using it to pad the length so we're not vulnerable to a timing attack.
foreach($passwords as $pass){
if(hash_equals($u,hash('md5',$pass,true))){
$authed=true;
break;
}
}
}
// here $authed is true if a correct password was supplied

Answer 2

once try:
$password = "anything";
$password = $password . "mypass";
//anythingmypass
if (isset($_POST["password"]) && $_POST["password"] != $password) {
print '<p align="center"><font color="red"><b>Wrong Password !!!</b><br>Please enter the correct Password</font></p>';
} else if (isset($_POST['password']) && $_POST['password']==$password) {
echo "password correct";
}
print '<form method="post"><p align="center"><b>Please enter the Password</b><br/><br/>';
print '<b>Password </b><input class="box" name="password" type="password" maxlength="' . strlen($password).'"><input class="button" value="Download" type="submit"></p></form>';

Answer 3

I think you want to do this
$passwordList = ['password','secretPassword','anything'];
if (isset($_POST["password"]) && in_array($_POST["password"], $passwordList)) {
// do protected stuff here
}
BUT. THERE IS A BIG BUT
NEVER EVER STORE PASSOWRDS IN CODE. Use a database for this.
I recommend you to follow there tutorials from Laracasts to get more familiar with PHP