strlen() is not working properly [closed] - php

Question

Closed. This question needs debugging details. It is not currently accepting answers.
Edit the question to include desired behavior, a specific problem or error, and the shortest code necessary to reproduce the problem. This will help others answer the question.
Closed 7 years ago.
Improve this question
i am not really good at this, this is my code. it seems like strlen() is not working, can someone help me figure what is wrong? thanks. it keeps on printing that password is too short even if i put 5 or more letters
<?php
if($username)
{
if(isset($_POST['submit']))
{
$newpass =md5($_POST['newpass']);
$confirmpass = md5($_POST['confirmpass']);
if(strlen($newpass) < 5)
{
if($newpass == $confirmpass)
{
$querychange = mysql_query("UPDATE users SET password = '$newpass' WHERE username = '$username'");
session_destroy();
?> <script> alert ( "Your password has been changed!" );
window.location='login.php'; </script> <?php
}
else
{
?> <script> alert ("New passwords don't match!" ); </script> <?php
}
}
else
{
echo "<font color='red'> * new password too short";
}
}
}
?>

Answer 1

First of all - doing md5 to a string will return a 32-character string.
That means that any password input by user will be hashed to a string of length 32.
This means that if(strlen($newpass) < 5) will never be true and you will always see a warning.
In this string you probably want if(strlen($newpass) > 5) - see, greater.
Then you password will be processed.
So, final code can be:
if(isset($_POST['submit'])) {
if(strlen($_POST['newpass']) >= 5)
{
$newpass = md5($_POST['newpass']);
$confirmpass = md5($_POST['confirmpass']);
// do other stuff
} else {
// warn about short password
}
}
Also take into consideration that strlen on UTF-8 encoded strings may give you unexpected results.
And for passwords you must use better methods then md5. Look at password_hash, password_verify.