PHP - Password Encryption, Sha1() Or ?

(Main Objective)
I need this login class to encrypt the password before it sends it to the database for login verification.

(Alternative Solution)
Force a login with just the username and captcha no password..


This is the original working script..

<?
session_start();
include "config.php";
global $c;
include "data.php";
global $config;
require('funciones.php');
if ($_POST['username']) {


session_start(); 
if($_POST['code']!=$_SESSION['string']){ 
header("Location: login.php?error=1");
}


//Comprobacion del envio del nombre de usuario y password

$username=uc($_POST['username']);
$password=uc($_POST['password']);

if ($password==NULL) {
header("Location: login.php?error=2");
}else{


$query = mysql_query("SELECT username,password FROM tb_users WHERE username = '$username'") or die(mysql_error());
if(mysql_num_rows($query) == 0)
{
header("Location: login.php?error=3");
} else {
$data = mysql_fetch_array($query);
if($data['password'] != $password) {
header("Location: login.php?error=4");
}else{
$query = mysql_query("SELECT username,password FROM tb_users WHERE username = '$username'") or die(mysql_error());
$row = mysql_fetch_array($query);

$nicke=$row['username'];
$passe=$row['password'];

//90 day  cookie
setcookie("usNick",$nicke,time()+7776000);
setcookie("usPass",$passe,time()+7776000);


$lastlogdate=time();
$lastip = getRealIP();

$querybt = "UPDATE tb_users SET lastlogdate='$lastlogdate', lastiplog='$lastip' WHERE username='$nicke'";
mysql_query($querybt) or die(mysql_error());

header("Location: members.php");
// echo "Has sido logueado correctamente ".$_SESSION['s_username']." y puedes acceder al index.php.";
// echo "<script>location.href='index.php';</script>";
?>

<META HTTP-EQUIV="REFRESH" CONTENT="0;URL=members.php">

<?
}
}
}
}
?>

<div class="heading">Login</div><br />
<?
if($_GET['error'] == 1)
{
print "<b>Error</b> - Wrong Captcha Code<br /><br/>";
}
if($_GET['error'] == 2)
{
print "<b>Error</b> - Please supply a password<br /><br/>";
}
if($_GET['error'] == 3)
{
print "<b>Error</b> - Invalid Username<br><br>";
}
if($_GET['error'] == 4)
{
print "<b>Error</b> - Invalid Password<br /><br />";
}
?>

<form action="login.php" method="post">
    <table>
        <tr>
            <td class="midtext">Username:</td>
            <td>
            <input type="text" name="username" size="25" class="form" autocomplete="off"></td>
        </tr>
        <tr>
            <td class="midtext">Password:</td>
            <td>
            <input type="password" name="password" size="25" class="form" autocomplete="off"></td>
        </tr>
        <tr>
            <td class="midtext" valign="top">Security Code:</td>
            <td class="midtext">
            <img src="image.php" onclick="this.src='image.php?newtime=' + (new Date()).getTime();">(Click 
            to reload)<br />
            <input type="text" name="code" size="17" maxlength="17" autocomplete="off" class="form"></td>
        </tr>
        <tr>
            <td></td>
            <td align="right">
            <input type="submit" value="Login" name="loginsubmit" class="form"></td>
        </tr>
    </table>
</form>


Let me know if you need any files...

hi im testing out my site and basically when users register their passwords and encrypted for security obs however when i go to test the login with the exact same password as the one used to register the system detects it as invalid when its not, I've literally copy pasted the password so that i was sure it was the same therefore the issue is within the encryption does anyone have an idea how to overcome this I've tested changed names of variables but nothing seems to help I've even got an error reporting function but no error is detected

<?php
error_reporting(E_ALL);
include_once("conninfo2.php");

if(isset($_POST['username']) && trim($_POST['username']) != ""){
	$username = strip_tags($_POST['username']);
	$password = $_POST['password'];
	$hmac = hash_hmac('sha512', $password, file_get_contents('textfiles/key.txt'));
	$stmt1 = $db->prepare("SELECT usersid, password FROM login WHERE username=:username AND activated='1' LIMIT 1");
	$stmt1->bindValue(':username',$username,PDO::PARAM_STR);
	try{
		$stmt1->execute();
		$count = $stmt1->rowCount();
		if($count > 0){
			while($row = $stmt1->fetch(PDO::FETCH_ASSOC)){
				$uid = $row['usersid'];
				$hash = $row['password'];
			}
			if (crypt($hmac, $hash) === $hash) {
				$db->query("UPDATE login SET lastlog=now() WHERE usersid='$uid' LIMIT 1");
				$_SESSION['uid'] = $uid;
				$_SESSION['username'] = $username;
				$_SESSION['password'] = $hash;
				setcookie("usersid", $uid, strtotime( '+30 days' ), "/", "", "", TRUE);
				setcookie("username", $username, strtotime( '+30 days' ), "/", "", "", TRUE);
    				setcookie("password", $hash, strtotime( '+30 days' ), "/", "", "", TRUE); 
				 echo 'Valid password<br />'.$_SESSION['uid'].'<br />'.$_SESSION['username'].'<br />'.$_SESSION['password'].'
				<br />'.$_COOKIE['usersid']; 
				/*header("location: index.php");*/
				exit();
			} else {
				echo 'Invalid password Press back and try again<br />';
				exit();
			}
		}
		else{
			echo "A user with that email address does not exist here";
			$db = null;
			exit();
		}
	}
	catch(PDOException $e){
		echo $e->getMessage();
		$db = null;
		exit();
	}
}
?>				

Hello Everyone,

I have built a simple registration form shown below and Iam trying to get the users to have their passwords encrypted and then entered into my database. I am attempting to use md5 encryption. I have also attached the database connection script.

My goal is when I check my database, I want to see the following: ( id, name, username, encrypted password )

The issue I have is that the form does not process completely. All I get this error (Error: Unknown column 'd8578edf8458ce06fbc5bb76a58c5ca4' in 'field list' ).

Could some tell me or show me " What is it that needs to be corrected either in my Code or SQL insert and /or my Variables" to make this work correctly. I know that its probably a very, very simple fix... Im just stuck at this point.

I really appreciate your help.

thanks,
mrjap1

Code: [Select]
<?php
error_reporting(0);
if($_POST['submit'])
{ //Begining of full IF Statment
$name = $_POST['name'];
$username = $_POST['username'];
$password = $_POST['password'];
$confirm_password = $_POST['confirm_password'];
// Encrypt Pasword
$enc_password = md5($password);
//$enc_password2 = md5($confirm_password);


// Confirm All feild were filled out when submit button was pressed
if($name && $username && $password && $confirm_password) 
{
// Confirm that the NAME that you used is NOT greater than 30 characters  
 if(strlen($name)>24)
 {
 echo "<h2><center>YOUR NAME IS TOO LONG!!!!</center></h2><br>";
 }
// Confirm that the USERNAME that you used is NOT greater than 10 characters  
if(strlen($username)>10)
 {
 echo "<h2><center>YOUR USERNAME IS TOO LONG!!!!</center></h2><br>";
 }
 else {
 
// Confirm that the PASSWORD that you used MATCH & Between 6 and 15 characters  
if(strlen($password)>10 || strlen($password)<6)
 {
 echo "<h2><center>YOUR PASSWORD MUST BE BETWEEN 6 and 15 CHARACTERS!!!!</center></h2><br>";
 }
if($password == $confirm_password)
{
// Database Connection required
require "db_conncect.php";
// We Now connect to the Dabase and insert the Form input details
//------- ### ENTERING ALL INFORMATION INTO THE DATABASE BELOW ### --------// 


// 1. Create a database connection
$con = mysql_connect("localhost","root",""); // <-- THIS IS WHERE YOU " CAN CHANGE " THE USERNAME IS "root", PASSWORD IS "" ONLY.

if (!$con) {
  die('Database connection failed could not connect: ' . mysql_error());
  }
  
// 2. Select a database to use
$db_select = mysql_select_db("registernow_2012",$con); // <-- THE "registernow_2012" IS THE NAME OF THE DATABASE.
if (!$db_select) {
  die('Database selection failed could not connect: ' . mysql_error());
}

mysql_select_db("registernow_2012", $con); // <-- THE "registernow_2012" IS THE NAME OF THE DATABASE TO BE CONNECTED.

// <-- THE `registernow_2012` IS THE NAME OF THE DATABASE TO BE CONNECTED.... `visitors` IS THE TABLE WITH ALL THE FIELDS WITHI IN THE DATABASE.


$sql="INSERT INTO `registernow_2012`.`users` (
`id` ,
`name` ,
`username` ,
`$enc_password` ,
`confirm_password`
)
VALUES (
NULL , '$_POST[name]', '$_POST[username]', '[$enc_password]', '$_POST[confirm_password]'
)";


if (!mysql_query($sql,$con))
  {
  die('Error: ' . mysql_error());
}

// 3. Close Connection
mysql_close($con);

header("Location: index.php");  // <-- THIS IS WHERE YOU CAN CHANGE THE "Location: Thank you / Index page" of the THANK YOU PAGE.

}
else 
{
echo "<h2><center>PASSWORDS MUST MATCH!!!!!</center></h2><br>";
}

 }
 
//echo "<h2><center>WORKING!!!!</center></h2>";
}
else echo "<h2><center>ALL FEILDS MUST BE COMPLETED</center></h2>";

} //Ending of full IF Statment
?>

<!DOCTYPE html>
<html lang='en'>
<head>
<title>THE FORM MY WAY NOW</title>
</head>
<div id='centerstage'>
<form name="myform" action="workingitoutproperly.php" method="POST">
<p>
<label>Name</label><br>
<input type='text' name='name' value=''><br>
<label>UserName</label><br>
<input type='text' name='username' value=''><br>
<label>Password</label><br>
<input type='password' name='password' value=''><br>
<label>Re-Enter Password</label><br>
<input type='password' name='confirm_password' value=''><br>
<br>
<input type='submit' name='submit' value='REGISTER NOW!!'>
</p>
</form>
</div>
</html>

I don't know if my password encrytion has been done correctly / is actually secure. I don't have anything valuable at the moment that people would care to hack, but in the future I want to be absolutely certain I am doing it right.   This is my process, I am storing it as Varchar(255), did a cost test and 9 was my result

$hash = password_hash($passsword, PASSWORD_BCRYPT, array("cost"=>9));

I was told I don't need a salt since it is included in the password_hash function   Also I noticed most of the hashes if not all start like this, why is that?

$2y$09$

Thanks for any help
Edited by moose-en-a-gant, 08 January 2015 - 01:51 PM.

Is there anything wrong in doing this?

I currently have 100,000+ users all with their passwords hashed in md5(). I want to secure it a bit by simply hashing all of their existing hashes to sha1() and then check their password matches the sha1(md5()).

Is there any reason why I shouldn't do this?

Is this okay to do for dealing with passwords before running an insert query into a database?

$password = sha1(mysqli_real_escape_string($dbc, $_POST['password']));

Hi,
So basically this is error:
Code: [Select]
  if (strcmp($extuser,$username) == 0 && strcmp($extpass,$password) == 0)

extpass is a value it reads from the database. That value is sha1-hashed.
Password is plain and is sent via a form.

So what happens is the following:
extuser and username equals 0, as they match. extpass and password matches IF i put the sha1 hashed password as the password.
So no problems in that, it's supposed to work that way.

If we change the code a bit, so that the user shouldn't post an unknown password:
Code: [Select]
  if (strcmp($extuser,$username) == 0 && strcmp($extpass,sha1($password)) == 0)

Right, so we take the submitted password and sha1 it. Then check if that new string matches the database and whops, login failed.


Okay.. by doing some debugging by printing the actual values i conclude this:
The sha1($password) equals 139a8cf8be8..... while in my database all the letters are CaSe. This is most likely the error.. Any ideas for a fix?

I have the following array which builds a concatenation of the items in tree-like form.



$arrayT = array();
$arrayT[0] = "a";
$arrayT[1] = "b";
$arrayT[2] = "c";
$arrayT[3] = "d";
$arrayT[4] = "e";
$arrayT[5] = "f";
$arrayT[6] = "g";
$arrayT[7] = "h";

$arrayT = buildTree($arrayT);

print_r($arrayT);

function buildTree($array) {
    $arrayTree = $array;
    $start = 0;
    $end = count($arrayTree);

$i = 0;
    while ($start != $end - 1) {
        if ($i % 2 == 1) {
            $arrayTree[count($arrayTree) - 1].=$arrayTree[$start + $i];
        }
        else
            $arrayTree[] .= $arrayTree[$start + $i];
        $i++;
        if (($start + $i) == $end) {
            $i = 0;
            $start = $end;
            $end = count($arrayTree);
        }
    }
    return $arrayTree;
}



Example output is

Quote

Array ( => a [1] => b [2] => c [3] => d [4] => e [5] => f [6] => g [7] => h [8] => ab [9] => cd [10] => ef [11] => gh [12] => abcd [13] => efgh [14] => abcdefgh )


I would like the values to be hashed using sha1. e.g value at [8] ab would be the hash of a and [1] b, value [12]abcd would be the hash of the values at [8]ab and [9]cd. I modified it myself in the next code snippet but I still don't feel it's doing what it's meant
function buildTree($array) {
    $arrayTree = $array;
    $start = 0;
    $end = count($arrayTree);

$i = 0;
    while ($start != $end - 1) {
        if ($i % 2 == 1) {
            $arrayTree[count($arrayTree) - 1].=$arrayTree[$start + $i];

sha1($arrayTree[count($arrayTree)-1].=$arrayTree[$start + $i]);
        }
        else
            $arrayTree[] .= sha1($arrayTree[$start + $i]);
        $i++;
        if (($start + $i) == $end) {
            $i = 0;
            $start = $end;
            $end = count($arrayTree);
        }
    }
    return $arrayTree;
}

$val1 = sha1($arrayT[0]);

$val2 = sha1($arrayT[1]);

$val3 = sha1($val1.$val2);

$val4 = sha1("ab");
echo "VAL1 ".$val1;
echo "<br/>";
echo "VAL2 ".$val2;
echo "<br/>";
echo "VAL3 ".$val3;
echo "<br/>";
echo "VAL4 ".$val4;



Anyone any ideas? Thankyou.

Php Lovers,

 

When you register on my site, you supposed to get an account activation link emailed to confirm your email and account opening.

Activation Link contains activation code. Code, I wanted all numbers like so: 193736262829292

And not alphanumerical like so: djkqh3kl3lwnj3j22b

Someone did this line for me 1.5yrs back and only just came to my attention it is generating alphanumeric chars as I was checking the column where it would save the code to see if the column type is correct or not. Type was varchar all this time. If the code becomes only numerical then can switch column (account_activation_code) type to "INT".

	$account_activation_code = sha1( (string) mt_rand(0,99999999)); //Type Casted the INT to STRING on the 11st parameter of sha1 as it needs to be a string.         
	

Another programmer did that line 1.5yrs back. Lost contact with him. Tell me, why sha1 needs to be TypeCasted to "STRING" ? As far as I remember 1.5yrs back it had to be converted to STRING. Else, was giving error. I mean, we dealing with INT here "mt_rand(0,99999999)" so why php force us to TypeCast to STRING here ? Absurd! Right ?

Context:

	<?php 
	//Required PHP Files. 
include 'configurations_site.php'; //Required on all webpages of the site. Must include here too. Else, conn.php data would not be found. conn.php residing in site_configurations.php. 
include 'header_site.php'; 
	//Step 1: Before registering user Account, check if User is already registered or not. Else, check if User is registering through invitation or not. 
	//Check if User is already logged-in or not. Get the login_check() custom FUNCTION to check. 
if (login_check() === TRUE) 
{ 
    die("You are already logged-in! No need to register again!"); 
} 
	//Check if the Url contains a Sponsor Username or not. If not, then barr the registration. 
if (isset($_GET['sponsor_username']) && !empty($_GET['sponsor_username'])) 
{ 
    $sponsor_username = $_GET["sponsor_username"]; 
} 
else 
{   
    die("Signups only through invitations only!<br> 
    Therefore, you need to be invited by a registered member who knows you personally!"); 
} 
	if ($_SERVER['REQUEST_METHOD'] == "POST") 
{ 
    //Step 2: Check User submitted details. 
    
    //Check if User made all the required inputs or not. 
    if (isset($_POST["fb_tos_agreement_reply"]) || 
       isset($_POST["username"]) && 
       isset($_POST["password"]) && 
       isset($_POST["password_confirmation"]) && 
       isset($_POST["fb_tos"]) && 
       isset($_POST["primary_domain"]) && 
       isset($_POST["primary_domain_confirmation"]) && 
       isset($_POST["primary_website_email"]) && 
       isset($_POST["primary_website_email_confirmation"]) && 
       isset($_POST["age_range"])) { 
           
        //Step 3: Check User details for matches against database. If no matches then validate inputs to register User Account. 
           
        //Create Variables based on user inputs. 
        $fb_tos_agreement_reply = trim($_POST["fb_tos_agreement_reply"]); 
        $username = filter_var(trim($_POST["username"],FILTER_SANITIZE_STRING)); 
        $password = $_POST["password"]; 
        $password_confirmation = $_POST["password_confirmation"]; 
        $primary_website_domain = filter_var(trim($_POST["primary_website_domain"],FILTER_SANITIZE_DOMAIN)); 
        $primary_website_domain_confirmation = filter_var(trim($_POST["primary_website_domain_confirmation"],FILTER_SANITIZE_DOMAIN)); 
        $primary_website_email = filter_var(trim($_POST["primary_website_email"],FILTER_SANITIZE_EMAIL)); 
        $primary_website_email_confirmation = filter_var(trim($_POST["primary_website_email_confirmation"],FILTER_SANITIZE_EMAIL)); 
        $primary_website_email_extracted_domain = substr(strrchr($primary_website_email,"@"),1); 
        $age_range = filter_var(trim($_POST["age_range"],FILTER_SANITIZE_STRING)); 
        $account_activation_code = sha1( (string) mt_rand(0,99999999)); //Type Casted the INT to STRING on the 11st parameter of sha1 as it needs to be a string. 
        $account_activation_link = sprintf("http://www.%s/%s/activate_account.php?website_email=%s@account_activation_code=%s",
        $site_domain,$social_network_name,urlencode("$primary_website_email"),urlencode($account_activation_code));         
        $account_activation_status = 0; //1 = active; 0 = inactive. 
        $hashed_password = password_hash($password,PASSWORD_DEFAULT); //Encrypt the password. 
        
        if (strlen($fb_tos_agreement_reply) < 1 || $fb_tos_agreement_reply != "Yes") { 
            echo "You must agree to our <a href='tos.html'>Terms & Conditions</a>!"; 
        //Check if inputted Username is valid or not. 
        } elseif (!filter_var($username,FILTER_VALIDATE_STRING)) { 
            echo "You entered an Invalid Username!"; 
        //Check if inputted Username is between the required 8 to 30 characters long or not. 
        } elseif (strlen($username) < 8 || strlen($username) > 30) { 
            echo "Username has to be between 8 to 30 characters long!"; 
        //Check if Password is between 8 to 30 characters long or not. 
        } elseif (strlen($password) < 8 || strlen($password) > 30) { 
            echo "Password must be between 8 to 30 characters long!"; 
        //Check if both inputted Passwords match or not. 
        } elseif ($password != $password_confirmation) { 
            echo "Your entered 2 Passwords don't match!"; 
        //Check if both inputted Domains match or not. 
        } elseif ($primary_website_domain != $primary_website_domain_confirmation) { 
            echo "Your entered 2 Primary Website Domains don't match!"; 
        //Check if inputted Domain is valid or not. 
        } elseif (!filter_var($primary_website_domain,FILTER_VALIDATE_DOMAIN)) { 
            echo "You entered an Invalid Domain Name!"; 
        //Check if both Email Inputs match or not. 
        } elseif ($primary_website_email != $primary_website_email_confirmation) { 
            echo "Your 2 Email inputs don't match!"; 
        //Check if inputted Email is valid or not. 
        } elseif (!filter_var($primary_website_email,FILTER_VALIDATE_EMAIL)) { 
            echo "You entered an Invalid Email Address!";         
        //Check if inputted Domain and Email Domain match or not. 
        } elseif ($primary_website_email_extracted_domain != $primary_website_domain) { 
            echo "Your Email Address must belong to your Domain Name: \"$primary_website_domain\"!"; 
        } 
        else 
        { 
            //Select Username and Email to check against Mysql DB if they are already regsitered or not. 
            $stmt = mysqli_prepare($conn,"SELECT username,primary_domain,primary_website_email FROM users WHERE username = ? OR primary_domain = ? OR primary_website_email = ?"); 
            mysqli_stmt_bind_param($stmt,'sss',$username,$primary_website_domain,$primary_website_email); 
            mysqli_stmt_execute($stmt); 
            $result = mysqli_stmt_get_result($stmt); 
            $row = mysqli_fetch_array($result, MYSQLI_ASSOC); 
        
            //Check if inputted Username is already registered or not. 
            if ($row['username'] == $username) { 
                echo "That Username is already registered!"; 
            //Check if inputted Domain is already registered or not. 
            } elseif ($row['primary_domain'] == $primary_website_domain) { 
                echo "That Domain Name is already registered!"; 
            //Check if inputted Email is already registered or not. 
            } elseif ($row['primary_website_email'] == $primary_website_email) { 
                echo "That Email Address is already registered!"; 
            } 
            else 
            { 
                //Insert the User's inputs into Mysql database using Php's Sql Injection Prevention Method "Prepared Statements". 
                $stmt = mysqli_prepare($conn,"INSERT INTO users(account_activation_code,account_activation_status,id_video_verification_status,sponsor_username,recruits_number,username,password,primary_domain,primary_website_email,age_range,registering_country,registering_ip,registering_browser,registering_os,registering_isp) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)"); 
                mysqli_stmt_bind_param($stmt,'siisissssssssss',$account_activation_code,$account_activation_status,$id_video_verification_status,$sponsor_username,$recruits_number,$username,$hashed_password,$primary_website_domain,$primary_website_email,$age_range,$registering_country,$registering_ip,$registering_browser,$registering_os,$registering_isp); 
                mysqli_stmt_execute($stmt); 
            
                //Check if User's registration data was successfully submitted or not. 
                if (!$stmt) 
                { 
                    echo "Sorry! Our system is currently experiencing a problem registering your account! You may try registering some other time!"; 
                    exit(); 
                } 
                else 
                { 
                    //Email the Account Activation Link for the User to click it to confirm their email and activate their new account. 
                    $to = "$primary_website_email";                 
                    $subject = "Your ".$site_name." Account Activation Details"; 
                    $body = nl2br(" 
                    ===============================\r\n 
                    ".$site_name." \r\n 
                    ===============================\r\n 
                    From: ".$site_admin_email."\r\n 
                    To: ".$primary_website_email."\r\n 
                    Subject: Your ".$subject."\r\n 
                    Message: ".$username."\r\n 
                    You need to click on this following <a href=".$account_activation_link.">link</a> to activate your account.\r\n
                    "); 
                    $headers = "From: ".$site_admin_email."\r\n"; 
            
                    if (!mail($to,$subject,$body,$headers)) 
                    { 
                        echo "Sorry! We have failed to email you your Account Activation details. Please contact the website administrator!"; 
                        exit(); 
                    } 
                    else 
                    { 
                        echo "<h3 style='text-align:center'>Thank you for your registration!<br /> Check your email $website_email for details on how to activate your account which you just registered.<h3>"; 
                        exit(); 
                    } 
                } 
            } 
        } 
    } 
}    
	?> 
	<!DOCTYPE html> 
<html> 
    <head> 
        <title><?php echo "$social_network_name";?> Signup Page</title> 
    </head> 
<body> 
<div class ="container"> 
	<?php 
//Error Messages. 
if (isset($_SESSION['error']) && !empty($_SESSION['error'])) { 
    echo '<p style="color:red;">'.$_SESSION['error'].'</p>'; 
} 
?> 
	<?php 
//Session Messages. 
if (isset($_SESSION['message']) && !empty($_SESSION['message'])) { 
    echo '<p style="color:red;">'.$_SESSION['error'].'</p>'; 
} 
?> 
	<?php 
//Clear Registration Session. 
function clear_registration_session() 
    { 
        //Clear the User Form inputs, Session Messages and Session Errors so they can no longer be used. 
        unset($_SESSION['message']); 
        unset($_SESSION['error']); 
        unset($_POST); 
        exit(); 
    } 
?> 
<h2><p align="center"><?php echo "$site_name Member Sign Up Form";?></p></h2> 
<form name "registration_form" method = "post" action="" enctype = "multipart/form-data"> 
    <div class="form-group"> 
        <p align="left"><label>Username:</label> 
        <input type="text" placeholder="Enter a unique Username" name="username" required [A-Za-z0-9] autocorrect=off value="<?php if(isset($_POST['username'])) { echo htmlentities($_POST['username']); }?>">
        </p> 
    </div> 
    <div class="form-group"> 
        <p align="left"><label>Password:</label> 
        <input type="password" placeholder="Enter a new Password" name="password" required [A-Za-z0-9] autocorrect=off>
        </p>     
    </div> 
    <div class="form-group">     
        <p align="left"><label>Repeat Password:</label> 
        <input type="password" placeholder="Repeat Password" name="password_confirmation" required [A-Za-z0-9] autocorrect=off>
        </p> 
    </div> 
    <div class="form-group"> 
        <p align="left"><label>Primary Domain:</label> 
        <input type="text" placeholder="Enter your Primary Domain" name="primary_website_domain" required [A-Za-z0-9] autocorrect=off value="<?php if(isset($_POST['primary_website_domain'])) { echo htmlentities($_POST['primary_website_domain']); }?>">
        </p> 
    </div> 
    <div class="form-group"> 
        <p align="left"><label>Repeat Primary Domain:</label> 
        <input type="text" placeholder="Repeat Primary Domain" name="primary_website_domain_confirmation" required [A-Za-z0-9] autocorrect=off value="<?php if(isset($_POST['primary_website_domain_confirmation'])) { echo htmlentities($_POST['primary_website_domain_confirmation']); }?>">
        </p> 
    </div> 
    <div class="form-group"> 
        <p align="left"><label>Primary Website Email:</label> 
        <input type="text" placeholder="Primary Website Email" name="primary_website_email" required [A-Za-z0-9] autocorrect=off value="<?php if(isset($_POST['primary_website_email'])) { echo htmlentities($_POST['primary_website_email']); }?>">
        </p> 
    </div> 
    <div class="form-group"> 
        <p align="left"><label>Repeat Primary Website Email:</label> 
        <input type="text" placeholder="Repeat Website Email" name="primary_website_email_confirmation" required [A-Za-z0-9] autocorrect=off value="<?php if(isset($_POST['primary_website_email_confirmation'])) { echo htmlentities($_POST['primary_website_email_confirmation']); }?>">
        </p> 
    </div> 
    <div class="form-group"> 
        <p align="left"><label>Age Range:</label> 
        <input type="radio" name="age_range" value="18-20" <?php if(isset($_POST['age_range'])) { echo 'checked'; }?> required>18-20 
        <input type="radio" name="age_range" value="21-25" <?php if(isset($_POST['age_range'])) { echo 'checked'; }?> required>21-25 
        <input type="radio" name="age_range" value="26-30" <?php if(isset($_POST['age_range'])) { echo 'checked'; }?> required>26-30 
        <input type="radio" name="age_range" value="31-35" <?php if(isset($_POST['age_range'])) { echo 'checked'; }?> required>31-35 
        <input type="radio" name="age_range" value="36-40" <?php if(isset($_POST['age_range'])) { echo 'checked'; }?> required>36-40 
        <input type="radio" name="age_range" value="41-45" <?php if(isset($_POST['age_range'])) { echo 'checked'; }?> required>41-45 
        <input type="radio" name="age_range" value="46-50" <?php if(isset($_POST['age_range'])) { echo 'checked'; }?> required>46-50  
        <input type="radio" name="age_range" value="51-55" <?php if(isset($_POST['age_range'])) { echo 'checked'; }?> required>51-55 
        <input type="radio" name="age_range" value="56-60" <?php if(isset($_POST['age_range'])) { echo 'checked'; }?> required>56-60 
        <input type="radio" name="age_range" value="61-65" <?php if(isset($_POST['age_range'])) { echo 'checked'; }?> required>61-65  
        <input type="radio" name="age_range" value="66-70" <?php if(isset($_POST['age_range'])) { echo 'checked'; }?> required>66-70 
        <input type="radio" name="age_range" value="71-75" <?php if(isset($_POST['age_range'])) { echo 'checked'; }?> required>71-75
        </p>  
    </div>
    <div class="form-group"> 
        <p align="left"><label>Agree To Our Terms & Conditions ? :</label> 
        <input type="radio" name="fb_tos_agreement_reply" value="Yes" <?php if(isset($_POST['fb_tos_agreement_reply'])) { echo 'checked'; }?> required>Yes  
        <input type="radio" name="fb_tos_agreement_reply" value="No" <?php if(isset($_POST['fb_tos_agreement_reply'])) { echo 'checked'; }?> required>No
        </p>  
    </div> 
<p align="left"><input type="submit" class="btn btn-default" name="submit" value="Submit"></p> 
<p align="left"><input type="reset" class="btn btn-default" name="reset" value="Reset"></p> 
<p align="left"><font color="red" size="3"><b>Already have an account ?</b><a href="login.php">Login here!</a></font></p> 
</form> 
</div> 
</body> 
</html>      
	

 

I am still experimenting with SANITIZATION and so ignore the SANITIZATION lines.

 

Hello all,

I looked everytwhere to find the answer to my question bug so far, no luck. I hope someone here can help me with this issue.

Oke, my problem is as following.

I'm creating a string with a foreach loop that I then will has after the loop. The problem is, is that that string is addad to a variable. When I sha1 hash that variable with the sha1 function from within PHP I get a different hash as when I just echo the string and manually hash that.

The point is, is that the manually hashed string is then correct, and the automitically hash string isn't.

This is the code I'm using, can someone tell me where to look at to solve this problem?


if (is_array($this->getFormData())){
     foreach ($this->getFormData() as $name => $value) { 
         $string .= $name."=".$value.$shamethod;
   }
}
$hashstring = sha1($string, false);
echo '<br /><br />'.$hashstring.'<br /><br />';
echo $string;


Thanks for  your time.

Dok

Hi everyone 

I'm new around here but thought it's about time I joined a good PHP forum! I'll introduce myself properly on the right section, but for now, I'll my post my coding problem on here. I wonder if any has any knowledge or can help.

I'm setting up a connection from my web server to a potential data supplier web server, which involves a load of encryption. One of the stages is generating a SHA1 hash of an encrypted string.

Now I've got some old example code, however the "mhash" function used in this old code appears to obsolete. Thus is doesn't work.

I've tried using the available "sha1" and "hash" functions but cannot replicate the hashed output they provide.

Here's the original code:
Code: [Select]
$encrypted_string = "B0436CBFBC5CAAFB7339AF4A1DF845974D53B9D369146E2E4F1451929D9EBE254363E983F4F94517EB9585FDB112E7B1CCE11A33C5BBA23F8D5DE9D3415BA526489AC796A36FBA76D4293C8DFB673708CED10C9732EEC472D9E43D2626AA104121666E79DD8F2FF6BAC0143BD62E0EE826AF6459779C162613508D48BFE2FC8DD558A1834D7205F96EA8D446E9B371E78E990A3995B1052DCBA9CA0AF99CC77ED2A8B55B2B882BA29D4BB4B07FA91AB4D2F10FBB93732B077335A7E6D96FE813AEDC3711A85CD0C13AE22B28C14FCCE3AF4C1F5D2C0F7697DEC7487CCFC0ED4E77B1B65F39BAD5236E3D3C69D33FC484";

$hashBinaryValue = mhash(MHASH_SHA1, $encrypted_string);
$hashValue = bin2hex($hashBinaryValue);
echo 'hashValue='.$hashValue.'<br>';
The example hashed output should be:
Code: [Select]
31f6d26b18d3c04895cdc2cc05cbd9ad003f2d3e
I cannot seem to replicate this output using the available functions? I've tried the following:
Code: [Select]
$hashBinaryValue = hash('sha1', $encrypted_string);
$hashValue = bin2hex($hashBinaryValue);
And also:
Code: [Select]
$hashBinaryValue = sha1($encrypted_string);
$hashValue = bin2hex($hashBinaryValue);
Both generate:
Code: [Select]
37333736363862393037313732326265346438396433633236383936363430376434613665363231
I've found a webpage that can generate the SHA1 hash, but do not know what language they've done it in.
http://www.fileformat.info/tool/hash.htm?hex=B0436CBFBC5CAAFB7339AF4A1DF845974D53B9D369146E2E4F1451929D9EBE254363E983F4F94517EB9585FDB112E7B1CCE11A33C5BBA23F8D5DE9D3415BA526489AC796A36FBA76D4293C8DFB673708CED10C9732EEC472D9E43D2626AA104121666E79DD8F2FF6BAC0143BD62E0EE826AF6459779C162613508D48BFE2FC8DD558A1834D7205F96EA8D446E9B371E78E990A3995B1052DCBA9CA0AF99CC77ED2A8B55B2B882BA29D4BB4B07FA91AB4D2F10FBB93732B077335A7E6D96FE813AEDC3711A85CD0C13AE22B28C14FCCE3AF4C1F5D2C0F7697DEC7487CCFC0ED4E77B1B65F39BAD5236E3D3C69D33FC484

Any help or input would be greatly appreciated =)

Hello PhP Freaks forum
In the past weeks ive been trying to make a website, where you can register. Everything seems to work except my cherished Change password feature. Everytime you try to change the password, it just resets it to nothing.

Here is the code below.

<?php
         if(isset($_SESSION['username']))
         {
            $username = $_SESSION['username'];
            $lastname = $_SESSION['lastname'];
            $firstname = $_SESSION['firstname'];
            $email = $_SESSION['email'];
               
            echo "
            
               <h4>Options for:</h4> &nbsp; $username
               <br />
               <br />
               First name: &nbsp; $firstname
            
               <br />Last name: &nbsp; $lastname       
   
   <br /><br /><h3>Want to change your password:</h3><br />
   
      <form action='?do=option' method='post'>
   
      Old password <input type='password' placeholder='Has to be between 5-15 digits' name='password' size='30' value='' /><br />
                  <br />
      New Password<input type='password' placeholder='Has to be between 5-15 digits' name='newpass' size='30' value='' /><br />
                  <br />
      Confirm new password <input type='password' placeholder='Has to be between 5-15 digits' name='passconf' size='30' value='' /><br />
                  
      <center></div><input type='submit' value='Submit'/></center></form>";   
      
            
         }else{
            echo 'Please login to view your options!';
         }
      
      $password = $_REQUEST['password'];
      $pass_conf = $_REQUEST['newpass'];
      $email = $_REQUEST['passconf'];
      
      $connect = mysql_connect("Host", "User", "Password");
      if(!$connect){
      die(mysql_error());
      }
      
      //Selecting database
      $select_db = mysql_select_db("My Database", $connect);
      if(!$select_db){
      die(mysql_error());
      }
      
      //Find if entered data is correct
      
      $result = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password'");
      $row = mysql_fetch_array($result);
      $id = $row['id'];

            
         mysql_query("UPDATE users SET password='$newpass' WHERE username='$user'")
      
      ?>          

And i do know that i dont have a

if(Empty($newpass)){
Die(Please fill out the new password)                                                 
}

Or any security on the others, but the problem just seems that it resets the password into nothing

Hope i can get this fixed

Best Regards

William Pfaffe

<?php
require_once('upper.php');
require_once('database.php');
echo $error_msg='';
if(isset($_POST['submit']))
{
$LoginId=mysqli_real_escape_string($dbc,trim($_POST['LoginId']));
$Password1=mysqli_real_escape_string($dbc,trim($_POST['Password1']));
$Password2=mysqli_real_escape_string($dbc,trim($_POST['Password2']));
$Name=mysqli_real_escape_string($dbc,trim($_POST['Name']));
$Age=mysqli_real_escape_string($dbc,trim($_POST['Age']));
$BloodGroup=mysqli_real_escape_string($dbc,trim($_POST['BloodGroup']));
if(!isset($_POST['Sex']))
{
echo 'Please enter Sex<br>';
}
else{
$Sex= mysqli_real_escape_string($dbc,trim($_POST['Sex']));
}
$Qualification=mysqli_real_escape_string($dbc,trim($_POST['Qualification']));
$ContactNumber=mysqli_real_escape_string($dbc,trim($_POST['ContactNumber']));
$Email=mysqli_real_escape_string($dbc,trim($_POST['Email']));
$Address=mysqli_real_escape_string($dbc,trim($_POST['Address']));
$AboutYourself=mysqli_real_escape_string($dbc,trim($_POST['AboutYourself']));
//$countCheck=count($_POST['checkbox']);
//echo $countCheck;
//$checkbox=$_POST['checkbox'];
//$countCheck=count($checkbox);
if(empty($LoginId)){echo 'Please enter Login Id';}
elseif(empty($Password1)){echo 'Please enter Password';}
elseif(empty($Password2)){echo 'Please confirm Password';}
elseif($Password1!==$Password2){echo 'Password didn\'t match';}
elseif(empty($Name)){echo 'Please enter Name';}
elseif(empty($Age)){echo 'Please enter Age';}
elseif(!isset($_POST['Sex'])){}
elseif(empty($Qualification)){echo 'Please enter Qualification';}
elseif(empty($ContactNumber)){echo 'Please enter Contact Number';}
elseif(empty($Email)){echo 'Please enter Email';}
elseif(empty($Address)){echo 'Please enter Address';}
elseif(empty($AboutYourself)){echo 'Please enter About Yourself';}
elseif(!isset($_POST['checkbox'])){ echo 'You have to register at least one activity.';}
elseif(!isset($_POST['TermsAndConditions'])){ echo 'You have to agree all Terms and Conditions of Elite Brigade.';}
else
{
require_once('database.php');
$query="select * from registration where LoginId='$LoginId'";
$result=mysqli_query($dbc,$query);
if(mysqli_num_rows($result)==0)
{
$checkbox=$_POST['checkbox'];
$countCheck=count($_POST['checkbox']);
$reg_id=' ';
for($i=0;$i<$countCheck;$i++)
{
$reg_id=$reg_id.$checkbox[$i].',';
$query="insert into activity_participation (LoginId,Title,Date) values ('$LoginId','$checkbox[$i]',CURDATE())";
$result=mysqli_query($dbc,$query) or die("Not Connected");
}
$query="insert into registration (LoginId,Password,Name,Age,BloodGroup,Sex,Qualification,ContactNumber,Email,Address,AboutYourself,Activity)values ('$LoginId'[B],SHA('$Password1'),[/B]'$Name','$Age','$BloodGroup','$Sex','$Qualification','$ContactNumber','$Email','$Address','$AboutYourself',',$reg_id')";
$result=mysqli_query($dbc,$query) or die("Not Connect");

echo ' Dear '.$Name.'.<br>Your request has been mailed to admin.<br>Your account is waiting for approval<br>';
$from= 'Elite Brigade';
$to='ankitp@rsquareonline.com';
$subject='New User Registration';
$message="Dear admin,\n\nA new user request for registration. Please check it out.\n\nRegards\nMicro";
mail($to,$subject,$message,'From:'.$from);
//header('Location: index.php');
// header('Location: Registration.php');
}
else
{
echo 'Dear '.$Name. ', <br> An account already exist with login-id<b> '.$LoginId.'</b> <br>Please try another login-id';
}}
}
?>

<html>
<head>
<script src="jquery-latest.js"></script>
  <script type="text/javascript" src="jquery-validate.js"></script>
<style type="text/css">
* { font-family: Verdana;  }

label.error {  color: white;  padding-left: .5em; }
p { clear: both; }
.submit { margin-left: 12em; }
em { font-weight: bold; padding-right: 1em; vertical-align: top; }
</style>
  <script>
  $(document).ready(function(){
    $("#commentForm").validate();
  });
  </script>
  
</head>

<body>

<?php
echo $error_msg; ?>

<form action='<?php echo $_SERVER['PHP_SELF'];?>' id="commentForm" method='post'>
<div class="registration_and_activity">

<table border="0" width="380">
<tr><td colspan="2">
<h3>New User?</h3></td></tr>
<tr><td width="120">

<em>*</em>Enter Login id</td><td width="150"><input type='text' name='LoginId'  minlength="4" value='<?php if(!empty($LoginId))echo $LoginId;?>' /></td></tr>
<tr><td>
<em>*</em>Enter Password</td> <td><head>
   <div id="divMayus" style="visibility:hidden">Caps Lock is on.</div>
   <SCRIPT language=Javascript>

function capLock(e){
 kc = e.keyCode?e.keyCode:e.which;
 sk = e.shiftKey?e.shiftKey:((kc == 16)?true:false);
 if(((kc >= 65 && kc <= 90) && !sk)||((kc >= 97 && kc <= 122) && sk))
  document.getElementById('divMayus').style.visibility = 'visible';
 else
  document.getElementById('divMayus').style.visibility = 'hidden';
}

</SCRIPT>
   </HEAD>
<input onkeypress='return capLock(event)' type='password' name='Password1' value='<?php if(!empty($Password1))echo $Password1;?>' /></td></tr>

<tr><td>
<em>*</em>Confirm Password</td><td><input type='password' name='Password2' value='<?php if(!empty($Password2))echo $Password2;?>' /></td></tr>
<tr><td width="120">
<em>*</em>Enter Name</td> <td><input type='text'  name='Name' value='<?php if(!empty($Name))echo $Name;?>' /></td></tr>
<tr><td>
<em>*</em>Enter Age</td><HEAD>
   <SCRIPT language=Javascript>
      
      function isNumberKey(evt)
      {
         var charCode = (evt.which) ? evt.which : event.keyCode
         if (charCode > 31 && (charCode < 48 || charCode > 57))
            return false;

         return true;
      }
  
  
     
   </SCRIPT>
   </HEAD>
<td><INPUT onkeypress='return isNumberKey(event)'  type='text' name='Age' value='<?php if(!empty($Age))echo $Age;?>'/></td></tr>

<tr><td>
<em>*</em>Enter Blood</td><td><input type='text' name='BloodGroup' value='<?php if(!empty($BloodGroup))echo $BloodGroup;?>' /></td></tr>

<tr><td>
<em>*</em>Enter Sex</td><td><input type='radio' name='Sex'  style='width:16px; border:0;' 'value='Male' />Male   <input type='radio' name='Sex' style='width:16px; border:0;' 'value='Female' />Female</td></tr>

<tr><td>
<em>*</em>Enter Qualification</td><td><input type='text' name='Qualification'  value='<?php if(!empty($Qualification))echo $Qualification;?>' /></td></tr>

<tr><td>
<em>*</em>Contact Number </td><td><input onkeypress='return isNumberKey(event)'type='text'  name='ContactNumber' value='<?php if(!empty($ContactNumber))echo $ContactNumber;?>' /></td></tr>

<tr><td>
<em>*</em>Enter Email</td><td><input type='text' name='Email'class="email" value='<?php if(!empty($Email))echo $Email;?>' /></td></tr>

<tr><td>
<em>*</em>Enter Address</td><td><input type='text'   name='Address' value='<?php if(!empty($Address))echo $Address;?>' /></td></tr>


<tr ><td >
<em>*</em>About Yourself </td></tr>
<tr><td colspan="2"><textarea rows='10' cols='40'  name='AboutYourself'  /><?php if(!empty($Address))echo $Address;?></textarea></td></tr>
<tr><td>

<?php echo"
<tr><td colspan='2'><em>*</em><b>Select fields for which you want to register</b></td></tr>";

require_once('database.php');
$query="select * from activity";
$result=mysqli_query($dbc,$query);
while($row=mysqli_fetch_array($result)){
$Title=$row['Title'];
$ActivityId=$row['ActivityId'];
echo "<tr><td>$Title</td>";
echo "<td><input type='checkbox' name='checkbox[]' value='$Title' style='width:14px; text-align:right;'/></td></tr>";//value=$ActivityId tells ActivityId variable extracts with name="checkbox"
echo "<br/>";
}
echo "<td><em>*</em><input type='checkbox' name='TermsAndConditions'  style='width:14px; text-align:right;'/></td><td> I agree all <a href='TermsAndConditions.php'>Terms and conditions </a>of Elite Brigade</td></tr>";
echo "<tr><td colspan='2' align='center'><input type='submit' value='Register' name='submit' style='background:url(./images/button_img2.png) no-repeat 10px 0px; width:100px; padding:3px 0 10px 0; color:#FEFBC4; border:0;'/></td></tr><br>";

echo " </td></tr></table>

</div>

</form>
</body>
</html>";
require_once('lower.php');

?>


Hi Friends ....
I encrypt user password by SHA('$Password') method but now i want to add "Forget Password Module" for which I need to decrypt it first before tell my user but I don't Know how to decrypt it.
Please help me........

This topic has been moved to Application Design.

http://www.phpfreaks.com/forums/index.php?topic=353345.0