PHP login checking hash in database using crypt

Question

I am a newbie in programming and now studying about encryption on password storage, and during my experiments i ran into this login problem. I am trying to login comparing the hashed password in database and user input using php crypt() function:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Untitled Document</title>
</head>
<body>
<form method="post" action="index.php">
user name :<input type="text" name="uid" />
password :<input type="text" name="pas" />
<input type="submit"/>
</form>

<?php
if(isset($_POST['pas'])&&isset($_POST['uid']))
{
    $uid=$_POST['uid'];
    $pas=$_POST['pas'];

    require_once('class.DBConnect.php');
    $ob=new DBConnect('test');
    $ob->getData("select * from log where uid='$uid'",array('pas'));

    foreach($ob->columnData as $value)
    {
        $hashed_pas=$value;
    }

    if(crypt($pas,$hashed_pas)==$hashed_pas)
    {
       echo "loggin in";
    }
    else
    {
       echo "fail!!!";
    }
}

?>
</body>
</html>

The password is 'san'. The value of $hashed_pas is : $1$mG5.1k/.$/. and of crypt($pas,$hashed_pas) is: $1$mG5.1k/.$/.LHc4JCN6GRznyYWZ/Mi.

I want to know why is this happening.

I have used the auto-generated salt for hash stored in database.

class.DBConnect.php :

<?php
class DBConnect
{
    public $columnData=array();
    private $con,$rs;
    public function __construct($database)
    {
    $this->con=mysqli_connect("localhost","root","root",$database);
    if(mysqli_connect_errno())
    {
        echo "DB error is:".mysqli_connect_error();
    }

    }


    function test_input($data)
    {
      $data = trim($data);
      $data = stripslashes($data);
      $data = htmlspecialchars($data);
      return $data;
    }

    function make_safe($variable)
    {

        $variable = mysqli_real_escape_string($this->con,trim($variable));
        return $variable;
    }

    function getData($query,$column=array())
    {
        $this->rs=mysqli_query($this->con,$query);
        while($row=mysqli_fetch_array($this->rs))
        {
            foreach($column as $a)
            { 
              $this->columnData=array($row[$a]);
            }

        }

    }

    function checkDataExist()
    {   
      if(mysqli_num_rows($this->rs)==0)
      {
        return 0;
      }

      else
      {
      return 1;
      }
    }

}
?>

Please help me with this issue and suggest me industry level standards on these.

edit: I tried following codes and output was:

san : $1$pb2.8C3.$WhJ/zOEWZUXc/7fTEbcJe. san : $1$pb2.8C3.$WhJ/zOEWZUXc/7fTEbcJe.

$pas="san";
$hash= crypt($pas);
echo "$pas : $hash<br />";
$hash= crypt($pas,$hash);
echo "$pas : $hash";

so I am wondering why database comparison not working.

Try $hash = crypt($pas,'your_salt_string_here'); http://in3.php.net/crypt — Nouphal.M, Mar 01 '14 at 06:57
@nauphal: Thank you very much for your quick reply,I'l try you're suggestion but please consider my edit too, it's working there then why not in comparison? — San, Mar 01 '14 at 07:06
@Nouphal.M oh hell I feel stupid for this, it was varchar(14)!!! thank you very much for helping me out. — San, Mar 01 '14 at 07:26
true :) also am new to stackoverflow.. can i mark your comment as the solution to my question? if yes how. — San, Mar 01 '14 at 07:30
You can just click the up arrow on top left of the comment... 1 up — Nouphal.M, Mar 01 '14 at 07:35
There's no up arrow there for me, I don't know why. Please repost as answer maybe it'll help other stupid guys like me :) — San, Mar 01 '14 at 07:46
Note that for PHP 5.5 and up, or 5.3.7 and up with the password_compat library, you can use the very simply password_hash() and password_verify() functions - I put in links and examples at my answer to [PHP Secure password generation and storage](http://stackoverflow.com/a/22118442/1967612) — Anti-weakpasswords, Mar 02 '14 at 04:12

score 0 · Accepted Answer · answered Mar 01 '14 at 07:51

0

It seems like the length of your database field is not sufficient to hold the entire hashed string. If the string to be stored exceeds the length of the table field the data will get truncated.

answered Mar 01 '14 at 07:51

Nouphal.M

6,304
1
17
28

PHP login checking hash in database using crypt

1 Answers1