retrieving a sha1 encrypted password.. [duplicate] - php

Question

This question already has answers here:
How to reverse SHA1 Encrypted text [duplicate]
(3 answers)
Closed 9 years ago.
I don't think that my title is appropriate for my question.
My question is I have a simle login system just for test purposes, and I am using sha1 in encrypting my password into my database. which would look like this
sha1($_POST['..some_variable...'])
What would be the best way to retrieve my encrypted password as plain text for authentication purposes.
Like select my username and password from my database.

Answer 1

This should give you a good idea of how it works.
try {
$submittedEmail = !empty($_GET['email']) ? $_GET['email']: false;
$submittedHash = !empty($_GET['password']) ? hash('sha1', $_GET['password']): false;
if (!$submittedEmail || !$submittedHash) {
throw new \Exception('Required field(s) missing. Please try again.');
}
if ($stmt = $mysqli->prepare("SELECT hash FROM user WHERE email = ?")) {
$stmt->bind_param("s", $submittedEmail);
$stmt->execute();
$stmt->bind_result($storedHash);
$stmt->fetch();
$stmt->close();
}
if (!$submittedHash != $storedHash) {
throw new \Exception('Wrong credentials submitted. Please try again.');
}
echo 'User ok!';
} catch (Exception $e) {
echo $e->getMessage();
}
I would however recommend using PHPs password_verify
Since you probably aren't on PHP 5.5 yet you can use this class

Answer 2

When the user creates an account and/or password the first thing you need to do is create a random salt.
$salt = hash_hmac('sha512', "RandomStringHere", "EncryptionKeyHere");
You will store that salt in db along with their encrypted password. From there encrypt the text-based password to and store it in the db.
$encyptPassword = hash_hmac('sha512', "plainTextPassword" . $salt , "EncryptionKeyHere");
So now you have a salt and encrypted password associated with the user.
To authenticate it's as easy as getting the salt associated with the user, taking their un-encrypted password and encrypting it - seeing if it matches.
This way you never know the persons password, just if it matches when they try to log in.