PHP crypt password - php

Question

A simple Registration and login page for a website. I am trying to crypt the password + salting. That's what I have done but I am not sure if its correct.
This is what happens in the registration page:
$blowfish = '$2a$10$';
$salt = '8dF$d_3';
$hashedPass = crypt($password,$blowfish . $salt);
In the database, the password "RAYray99" is stored as "$2a$10$8dF$d_3$$$$$$$$$$$$$$.wxsfa7X.nkcGqldJ9fujdd8eY.H85uC"
On the login page, I am stuck on how to check the password entered with the password in the database.
This is the loging php script that verifies the user:
mysql_connect("$db_host", "$db_username", "$db_pass") or die(mysql_error());
//select the database or return error message
mysql_select_db("$db_name") or die("database does not exist");
$email = stripslashes($_POST['email']);
$email = strip_tags($email);
$email = mysql_real_escape_string($email);
$password = ereg_replace("[^A-Za-z0-9]", "", $_POST['password']); // filter everything but numbers and letters
$password = crypt($password);
$sql = mysql_query("SELECT * FROM members WHERE email='$email' AND password='$password' AND activateemail='1'");
$login_check = mysql_num_rows($sql);
if($login_check > 0){
while($row = mysql_fetch_array($sql)){
// Get member ID into a session variable
$id = $row["id"];
session_register('id');
$_SESSION['id'] = $id;
// Get member username into a session variable
$username = $row["username"];
session_register('username');
$_SESSION['username'] = $username;
// Update last_log_date field for this member now
mysql_query("UPDATE members SET lastlogin=now() WHERE id='$id'");
// Print success message here if all went well then exit the script
header("location: account.php");
exit();
} // close while
} else {
// Print login failure message to the user and link them back to your login page
print '<br /><br /><font color="#FF0000">ERROR TRY AGAIN </font><br />;
exit();
}
My question is how would I verify the login passsword entered on the login page with the 1 in the database.
Thank you,
Ray

Answer 1

To verify the password you should be hashing the entered one exactly the same way you did when you stored it in the first place.
I see some issues with what you have. First, the blowfish string for crypt() specifies, according to the PHP docs, that after your $2a$10$ should be a 22 character string from the alphabet of ./0-9A-Za-z. Your salt isn't following that, so the hash function is probably failing completely (though I'm not certain).
Also, your salt shouldn't be a constant in your app, it should be unique to each user and stored in the db along with their hashed password.
Finally, you shouldn't be doing those transformations to the password before hashing it. Break out a function that has the plaintext password as input, and outputs the hashed password. Use this function both when you store the password, and when you attempt to validate the login. That way you know for sure it should match the database.

Answer 2

I am using a mapper for my sql queries (doctrine2).
My passwords are saved with md5 + salt in my db
public function setPassword($password) {
$this->_password = self::encodePassword ( $password );
return $this;
}
/**
* This function encodes the password to md5 after adding a salt
* #param string $password
*/
public static function encodePassword($password) {
$salt = 'dsa7893ujlksdsagkz27392kjsjaldksju928ikljda27';
return md5 ( $password . $salt );
}
My login looks like this ...
/**
* Executes an authentication try
*
* #throws Zend_Auth_Adapter_Exception if the authentication failed
* #return Zend_Auth_Result
*/
public function authenticate()
{
//check if login is correct
try{
$user = $this->_em->getRepository('App_Model_User')
->findOneBy(
array(
'_email' => $this->_login,
'_password' => App_Model_User::encodePassword( $this->_password )
)
);
}catch( Exception $e ){
throw new Zend_Auth_Adapter_Exception( 'authentication failed', 0, $e );
}
.............

Answer 3

$password = $_POST['password'];
$str = "$2a$10$8dF$d_3$$$$$$$$$$$$$$.wxsfa7X.nkcGqldJ9fujdd8eY.H85uC";
if (preg_match('/^(.{7})(.{7})(.+?)$/', $str, $m))
{
$blowfish = $m[1];
$salt = $m[2];
$hashedPass = $m[3];
$validHashedPass = crypt($password,$blowfish.$salt);
if ($validHashedPass == $hashedPass)
{
good pass
}
else
{
wrong auth
}
}

Answer 4

I have a class built just for this case. It uses the sha1() hashing function and PDO prepared statements to prevent SQL injections. I'll try to find it and post it here, but if I don't, this is my advice to you:
Use a hashing function, not a crypting one.
Don't use mysql_* as it does not support prepared statements. Use PDO or at the very leat, mysqli.

Answer 5

As #Brad pointed out it'll be simpler (and to some extent safer) to hash the passwords instead of encrypting them.
MySQL supports both MD5 and SHA1 hashes anyhow.
One of the advantages of going this route is you can do either:
$pass = md5($salt . $pass);
$SQL = "SELECT * FROM users WHERE username = '$user' AND pass = '$pass';";
OR directly on the database
$SQL = "SELECT * FROM users WHERE username = '$user' AND pass = MD5('{$salt}{$pass}')";