php - mysql aes_encrypt and aes_decrypt -


i'm trying make login system encrypts , decrypt passwords in database(for project). can use aes_encrypt encrypt password , store them in database.however, when decrypt them later find matching passwords login, don't work. it's aes_decrypt skipped , not ran because have accounts plaintext password stored in database , can login them accounts encrypted passwords don't work. i'm using xampp phpmyadmin database. 

signup file <?php  if(isset($_post['signup'])) { mysql_connect("localhost","root",""); mysql_select_db("faceback");  $email=$_post['email'];  $que1=mysql_query("select * users email='$email'"); $count1=mysql_num_rows($que1);  if($count1>0) { echo "<script> alert('there existing account associated email.'); </script>"; } else { $name=$_post['first_name'].' '.$_post['last_name']; $password=$_post['password']; $gender=$_post['sex']; $birthday_date=$_post['day'].'-'.$_post['month'].'-'.$_post['year']; $fb_join_date=$_post['fb_join_time'];  $day=intval($_post['day']); $month=intval($_post['month']); $year=intval($_post['year']); if(checkdate($month,$day,$year)) { $que2=mysql_query("insert  users(name,email,password,gender,birthday_date,fb_join_date)  values('$name','$email',aes_encrypt('$password','897sdn9j98u98jk'), '$gender','$birthday_date','$fb_join_date')");  session_start(); $_session['tempfbuser']=$email; }  login file <?php   if(isset($_post['login'])) { mysql_connect("localhost","root",""); mysql_select_db("faceback");  $user=$_post['username']; $pass=$_post['password'];    $que1=mysql_query("select email,aes_decrypt(password,'897sdn9j98u98jk')  users email='$user' , password='$pass'"); $count1=mysql_num_rows($que1);  if($count1>0) { session_start(); $_session['tempfbuser']=$user; }

you save password database using aes_encrypt('$password','897sdn9j98u98jk' (in query).

but try retrieve plain-text password database using 

$pass=$_post['password']; // code omitted $que1=mysql_query("select email,aes_decrypt(password,'897sdn9j98u98jk')  users email='$user' , password='$pass'"); //                            ^^^^^^^^^^^^^^^^^

that reason why can login on accounts have plaintext password stored in database.

to fix have search encrypted password in where clause:

(...) (...) , password = aes_decrypt($pass, '897sdn9j98u98jk')

however:

you should not use encryption store passwords. should hash password using password_hash() , verify them using password_verify(). more information on why need hash password instead of encrypting them read fundamental difference between hashing , encryption algorithms.


Comments

Post a Comment

Popular posts from this blog

Command prompt result in label. Python 2.7 -

i want put result(output) of shell command label. command works, label shows "0", however, in command prompt, result shown correctly, need showed in label. doing ubuntu. myg1 = button(root, text="rodyti informacija", command=lambda: gauti()) myg1.pack(side=bottom) def gauti(): imti = tekstas.get("1.0", "end-1c") info = subprocess.call("id '{imti}' ".format(imti=imti), shell=true) w = label(root, text= info) w.pack(side = bottom) subprocess.call() returns exit code of process created (in case 0 success). if want text output of process, should instead call subprocess.check_output() .
Read more

javascript - How do I use URL parameters to change link href on page? -

i change href value of link using url parameters. example: default <a id="dlink" href="link-1">link</a> but, when user goes https://url.com/?dlink=link-2 it swaps out link new link <a id="dlink" href="link-2">link</a> first need value url. if you're not using javascript framework can create function using jquery. please check get url parameter jquery or how query string values in js it. after that, element "a" id , set value there. $("#dlink").attr("href", hreffromparam);
Read more

amazon web services - AWS Route53 Trying To Get Site To Resolve To www -

so have domain nameservers pointed aws route 53. site hosted on ec2 instance , reachable resolves site.com, if input www.site.com. i'm curious how site resolve www.site.com. have under route53 domains hosted zone 2 additional record sets outside of ns , soa: a site.com ec2 elastic ip cname www.site.com ec2 public dns i can reach site using both site.com , www.site.com, resolve site.com. there way make if enter either, resolves www.site.com? at first, both should record set. a site.com ec2 elastic ip www.site.com ec2 elastic ip and need redirect setting in web server (nginx, apache, ..) following. (source: how redirect www non-www nginx on centos 7 ) redirect non-www www if want redirect users plain, non-www domain www domain, add server block: server { server_name example.com; return 301 $scheme://www.example.com$request_uri; } save , exit. configures nginx redirect requests "example.com" "www.example.com". not...
Read more