Years ago I built a site that had login and account creation capability using SHA1 and MySQL. In preparation for a new webiste I loaded the old site into a droplet it still works fine. At the time SHA1 and simple input sanitizing was fine, but since then SHA1 has been cracked and PDO is recommended for sanitizing database values.<\/p>\n
The original code looked like this:
\n
\n\/\/ Read the data from the form\n$userlogin = htmlspecialchars($_POST['login']);\n$password = htmlspecialchars($_POST['password'];\n\/\/ The hash stored in the database.\n$passwdHash = sha1($Password);\n\n\/\/ Verification\n$userlogin = htmlspecialchars($_POST['login']);\n$password = htmlspecialchars$_POST['password'];\n$passwdHash = sha1($password);\n$sql = "SELECT *\nFROM users\nWHERE username = '$login' && password = '$passwdHash' ";<\/code><\/pre><\/p>\nWithout really thinking about it, I sanitized the password input with htmlspecialchars and in both storing and retrieving the password it didn\u2019t have any impact.<\/p>\n
I basically copied the code into my new project and then changed SHA1 to password_hash. That didn\u2019t work because the password_hash<\/i> requires password_verify<\/i> to check the hash when you retrieve it from the database. That worked when I tested the login code by copying and pasting the login info from php_error.log –> error_log(login: $userlogin hash: $hash)<\/code> into the users table. It didn\u2019t work when I created a signup page and entered the data automatically. The reason is that sanitizing the password with htmlspecialchars changes it somehow. This is what I do instead. Note that it doesn\u2019t matter what the user enters in the password field because the hash function transforms it into a 60 character hash so there is no need to sanitize.<\/p>\n\n\/\/ Read the data from the form\n\/\/ Sanitized passord is used in javascript just for checking that a password was entered\n$Password = htmlspecialchars($_POST["Password"]); \n$UserLogin = htmlspecialchars($_POST["UserLogin"]);\n$PasswdHash = password_hash($_POST["Password"], PASSWORD_DEFAULT);\n\n\/\/ Enter into the database with PDO\n$sql = "INSERT INTO `Database`.`users` (`user_login`, `user_pass`,\n$sql .= "VALUES (:user_login, user_pass, ...\n\n$stmt->bindParam(': user_login', $UserLogin);\n$stmt->bindParam(':user_pass', $PasswdHash);\n...\n\n\/\/ Validate the password. Retrieve by user_login only. \n\/\/ Don\u2019t do anything to the password that was entered by the user.\n\nforeach($result as $row) {\n $user_login = $row['user_login'];\n $hash = $row['user_pass'];\n\n if ( password_verify($_POST['password'], $hash) ) {\n $_SESSION['userID'] = $row['ID'];\n $_SESSION['userName'] = $row['user_name'];\n $_SESSION['userDisplayName'] = $row['display_name'];\n $passwordIsValid = TRUE;\n }<\/code><\/pre><\/p>\n","protected":false},"excerpt":{"rendered":"Years ago I built a site that had login and account creation capability using SHA1 and MySQL. In preparation for a new webiste I loaded the old site into a droplet it still works fine. At the time SHA1 and simple input sanitizing was fine, but since then SHA1 has been cracked and PDO is … Continue reading PHP password storage in MariaDB<\/span><\/a><\/p>\n","protected":false},"author":6,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34],"tags":[],"class_list":["post-2946","post","type-post","status-publish","format-standard","hentry","category-php"],"_links":{"self":[{"href":"https:\/\/www.wellgolly.com\/index.php?rest_route=\/wp\/v2\/posts\/2946","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wellgolly.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wellgolly.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wellgolly.com\/index.php?rest_route=\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wellgolly.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2946"}],"version-history":[{"count":4,"href":"https:\/\/www.wellgolly.com\/index.php?rest_route=\/wp\/v2\/posts\/2946\/revisions"}],"predecessor-version":[{"id":2950,"href":"https:\/\/www.wellgolly.com\/index.php?rest_route=\/wp\/v2\/posts\/2946\/revisions\/2950"}],"wp:attachment":[{"href":"https:\/\/www.wellgolly.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2946"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wellgolly.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2946"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wellgolly.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2946"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}