insert password into database in md5 format? [duplicate] - php

Question

This question already has answers here:
Secure hash and salt for PHP passwords
(14 answers)
How do I create and store md5 passwords in mysql
(9 answers)
Closed 9 years ago.
can anyone please show me or explain how i can insert a password into a database in md5 format? even if you can just point me in the right direction or something i'd be grateful because I'm only new to mysql thanks.
$query="INSERT INTO ptb_users (id,
user_id,
first_name,
last_name,
email )
VALUES('NULL',
'NULL',
'".$firstname."',
'".$lastname."',
'".$email."',
'".$password."'
)";
mysql_query($query) or dieerr();
$result = mysql_query("UPDATE ptb_users SET ptb_users.user_id=ptb_users.id");

Answer 1

use MD5,
$query="INSERT INTO ptb_users (id,
user_id,
first_name,
last_name,
email )
VALUES('NULL',
'NULL',
'".$firstname."',
'".$lastname."',
'".$email."',
MD5('".$password."')
)";
but MD5 is insecure. Use SHA2.
Encryption and Compression Functions
SQLFiddle Demo

Answer 2

Don't use MD5 as it is insecure. I would recommend using SHA or bcrypt with a salt:
SHA256('".$password."')
http://en.wikipedia.org/wiki/Salt_(cryptography)

Answer 3

Darren Davies is partially correct in saying that you should use a salt - there are several issues with his claim that MD5 is insecure.
You've said that you have to insert the password using an Md5 hash, but that doesn't really tell us why. Is it because that's the format used when validatinb the password? Do you have control over the code which validates the password?
The thing about using a salt is that it avoids the problem where 2 users have the same password - they'll also have the same hash - not a desirable outcome. By using a diferent salt for each password then this does not arise (with very large volumes of data there is still a risk of collisions arising from 2 different passwords - but we'll ignore that for now).
So you can aither generate a random value for the salt and store that in the record too, or you could use some of the data you already hold - such as the username:
$query="INSERT INTO ptb_users (id,
user_id,
first_name,
last_name,
email )
VALUES('NULL',
'NULL',
'".$firstname."',
'".$lastname."',
'".$email."',
MD5('"$user_id.$password."')
)";
(I am assuming that you've properly escaped all those strings earlier in your code)

Answer 4

if you want to use md5 encryptioon you can do it in your php script
$pass = $_GET['pass'];
$newPass = md5($pass)
and then insert it into the database that way, however MD5 is a one way encryption method and is near on impossible to decrypt without difficulty

Answer 5

You can use MD5() in mysql or md5() in php. To use salt add it to password before running md5, f.e.:
$salt ='my_string';
$hash = md5($salt . $password);
It's better to use different salt for every password. For this you have to save your salt in db (and also hash). While authentication user will send his login and pass. You will find his hash and salt in db and find out:
if ($hash == md5($salt . $_POST['password'])) {}