PHP - Php Hashing - Improve

Just a quick question.

I have heard a few people say that they store a specific (maybe random) salt string in the same row as the user that is generated when the user account is created or password is changed. But I thought one of the reasons people use hashing is so if someone managed to get hold of the database they couldn't decipher the password (like a simple md5'd string). But putting the salt string next to the username surely gives the attacker a major push in the right direction?

I am not claiming to know anything, I'm just asking because I'm trying to find the best practice (Or at least a good tried and tested one). I like the idea of having a salt in a php config file, because that would mean an attacker would actually have to get your files, and if they had got that far then your pretty much screwed anyway.

Hello all,

I looked everytwhere to find the answer to my question bug so far, no luck. I hope someone here can help me with this issue.

Oke, my problem is as following.

I'm creating a string with a foreach loop that I then will has after the loop. The problem is, is that that string is addad to a variable. When I sha1 hash that variable with the sha1 function from within PHP I get a different hash as when I just echo the string and manually hash that.

The point is, is that the manually hashed string is then correct, and the automitically hash string isn't.

This is the code I'm using, can someone tell me where to look at to solve this problem?


if (is_array($this->getFormData())){
     foreach ($this->getFormData() as $name => $value) { 
         $string .= $name."=".$value.$shamethod;
   }
}
$hashstring = sha1($string, false);
echo '<br /><br />'.$hashstring.'<br /><br />';
echo $string;


Thanks for  your time.

Dok

Hello

I've recently been made aware that I need to hash the token I use when allowing users to reset their password.

I have a working solution but I'm hoping someone could let me know if this is an adequate way of doing it;

1. User enters their email, I check whether their actually a member and then...     create a passcode (1)     create a salt (2)     hash them together to create a passcode_hash (3)     insert the (2) and (3) into the database     send an email to the user with a link using (1) and the userid in the address 2. When the link is followed...     $_GET the userid and lookup the salt and passcode_hash for that id     hash together the passcode in the URL with the salt, and compare that to passcode_hash     if that is successfull then allow an update of the password (show the update form) 3. The password update form is sent along with two hidden fields (the passcode and userid from the URL)     On the form processing script I perform the same check as on Step 2 to check the passcode and user id have not been messed with     Update the password and delete the passcode Hopefully that makes sense... is that correct?

Here is my code that compares the passcode with the passcode_hash....
 

// get the passcode and email from URL (I will sanitize these)
        $passcode = $_GET['passcode'];
        $member_id = $_GET['uid'];

        // find the salt associated with the userid
        $stmt = $db->prepare("SELECT passcode,salt FROM members_verify WHERE members_id = ?");
        $stmt->bind_param('i',$member_id);
        $stmt->execute();
        $stmt->bind_result($db_passcode,$salt);
        $stmt->fetch();
        $stmt->close();

        // Create salted password
        $passcode_hash = hash('sha512', $passcode . $salt);

        if($passcode_hash===$db_passcode){
            $allowUpdate = 'yes';
        }

Any advice would be great
Edited by paddyfields, 07 June 2014 - 08:18 AM.

I have a large number of files. It is recommended to save the files with hashing system to have fast access to files through the OS. But I have no practical knowledge about hash. Could you please give me a hint, how to save a file with hash coded system via php? and how to read the hash coded filename by php?

Thank you in advance!

Used to be a good option, but don't know anymore as password_hash() is now available.   Agree?   I understand that I shouldn't ever manually salt and disable the functions salting.  That being said, is there any reason to add a bit extra to the user's password (such as an internal ID and some random constant)?

<?php 
	function cryptPass($input, $rounds = 9){
	
		$salt = "";
	
		$saltChars = array_merge(range('A','Z'), range('a','z'), range(0,9));
	
		for($i = 0; $i < 22; $i++){
	
			$salt .= $saltChars[array_rand($saltChars)];
	
		}
		
		return crypt($input, sprintf('$2y$%02d$', $rounds) . $salt);
	
	}

	echo $inputPass = "password2";

	echo $pass = "password";

	$hashedPass = cryptPass($pass);

	echo $hashedPass;

	if(crypt($inputPass, $hashedPass) == $hashedPass){
	
		echo "<br /><h1>Password is a match = log user in</h1>";
	
	}else{
	
		echo "<br />Password does not match = do not log in";
	
	}
?>

My PHP version 5.2 When I run above code I am getting the password match answer. I should have get error message. Can anyone advise me . Thank you.

Hi everyone 

I'm new around here but thought it's about time I joined a good PHP forum! I'll introduce myself properly on the right section, but for now, I'll my post my coding problem on here. I wonder if any has any knowledge or can help.

I'm setting up a connection from my web server to a potential data supplier web server, which involves a load of encryption. One of the stages is generating a SHA1 hash of an encrypted string.

Now I've got some old example code, however the "mhash" function used in this old code appears to obsolete. Thus is doesn't work.

I've tried using the available "sha1" and "hash" functions but cannot replicate the hashed output they provide.

Here's the original code:
Code: [Select]
$encrypted_string = "B0436CBFBC5CAAFB7339AF4A1DF845974D53B9D369146E2E4F1451929D9EBE254363E983F4F94517EB9585FDB112E7B1CCE11A33C5BBA23F8D5DE9D3415BA526489AC796A36FBA76D4293C8DFB673708CED10C9732EEC472D9E43D2626AA104121666E79DD8F2FF6BAC0143BD62E0EE826AF6459779C162613508D48BFE2FC8DD558A1834D7205F96EA8D446E9B371E78E990A3995B1052DCBA9CA0AF99CC77ED2A8B55B2B882BA29D4BB4B07FA91AB4D2F10FBB93732B077335A7E6D96FE813AEDC3711A85CD0C13AE22B28C14FCCE3AF4C1F5D2C0F7697DEC7487CCFC0ED4E77B1B65F39BAD5236E3D3C69D33FC484";

$hashBinaryValue = mhash(MHASH_SHA1, $encrypted_string);
$hashValue = bin2hex($hashBinaryValue);
echo 'hashValue='.$hashValue.'<br>';
The example hashed output should be:
Code: [Select]
31f6d26b18d3c04895cdc2cc05cbd9ad003f2d3e
I cannot seem to replicate this output using the available functions? I've tried the following:
Code: [Select]
$hashBinaryValue = hash('sha1', $encrypted_string);
$hashValue = bin2hex($hashBinaryValue);
And also:
Code: [Select]
$hashBinaryValue = sha1($encrypted_string);
$hashValue = bin2hex($hashBinaryValue);
Both generate:
Code: [Select]
37333736363862393037313732326265346438396433633236383936363430376434613665363231
I've found a webpage that can generate the SHA1 hash, but do not know what language they've done it in.
http://www.fileformat.info/tool/hash.htm?hex=B0436CBFBC5CAAFB7339AF4A1DF845974D53B9D369146E2E4F1451929D9EBE254363E983F4F94517EB9585FDB112E7B1CCE11A33C5BBA23F8D5DE9D3415BA526489AC796A36FBA76D4293C8DFB673708CED10C9732EEC472D9E43D2626AA104121666E79DD8F2FF6BAC0143BD62E0EE826AF6459779C162613508D48BFE2FC8DD558A1834D7205F96EA8D446E9B371E78E990A3995B1052DCBA9CA0AF99CC77ED2A8B55B2B882BA29D4BB4B07FA91AB4D2F10FBB93732B077335A7E6D96FE813AEDC3711A85CD0C13AE22B28C14FCCE3AF4C1F5D2C0F7697DEC7487CCFC0ED4E77B1B65F39BAD5236E3D3C69D33FC484

Any help or input would be greatly appreciated =)

I need to secure my code more

Code: [Select]
$_POST['amount'] = intval($_POST['amount']);
if ($_POST['amount'] <= 0){
message($lang_common['Bad request']);
}
if (!is_numeric($_POST['amount'])){
message($lang_common['Bad request']);
}
$_POST['amount'] will be the amount of gold people will beable to send to each other.

any sql injections vulnerability right now? if so, help

i casted my intval and is_numeric on it

any other ways to secure it with php functions as of right now it can only be numeric right?

Hello.
I have written this script where user restaurant owner can add his place to the database of all local restaurants.
(insert basic information into database, add up to 3 images, thumbnail creation, insert image information to database).

It works well on localhost, but i would like some suggestions for improvement.
Im not very sure of its structure, it may not execute well once it is online.
And i also think there are too many "IF's". But i really have no idea how to do it any other way.

Thanks for all the suggestions.

Code: [Select]
<?php
if(!defined('PROTECTION') || constant('PROTECTION') != 'demover')
 {
echo "fuck off intruder!";
exit;  
 }
 
$naziv = mysql_real_escape_string($_POST['Naziv']);
$naslov = mysql_real_escape_string($_POST['Naslov']);
$kraj = mysql_real_escape_string($_POST['Kraj']);
$telefon = mysql_real_escape_string($_POST['Telefon']);
$web = "http://www.".mysql_real_escape_string($_POST['Spletna']);
$gm = mysql_real_escape_string($_POST['Lokacija']);

//$gmaps = gmParse($gm);
$gmaps = 10;

$fill="INSERT INTO bpoint
(sName, sAddr, placeID, sPhone, sWeb, sGMaps, companyID)
VALUES 
('$naziv','$naslov','$kraj','$telefon','$web','$gmaps','$cID')";

if (mysql_query($fill)) {
    
    $lastID=mysql_insert_id();
    $path="./truck/".$cID."/".$lastID;
    $pname=$_FILES["pic"]["tmp_name"];
    $num=0;
    
    if (count($_FILES["pic"]) && mkdir($path, 0777)) {
        
        include "thumbs.php";
        foreach($pname as $imag){
        $bname=date("YmdHis").$num;
        $num++;
        $finalpath=$path."/".$bname.".jpg";
        $finalthumb=$path."/".$bname."_thumb.jpg";
            
            if($imag!="") {
                
                if (move_uploaded_file($imag, $finalpath)) {
                    
                    make_thumb($finalpath,$finalthumb,150);
                    mysql_query("INSERT INTO images (name, companyID) VALUES ('$finalpath', '$cID')");
  
                }
                
            }
            
            
            
            
        }
        
        
    }
    
    unset($_FILES["pic"]);
    
} else {die(mysql_error());}
 
 
 
 
?>

This contact form works fairly well, but I do get spam. Can you add something to this existing form that will make it a little better at not letting spam thru?

<form action="../page.php?page=1" method="post" name="contact_us" onSubmit="return capCheck(this);">
<table cellpadding="5" width="100%">
<tr>
<td width="10" class="required_field">*</td>
<td width="80">Name</td>
<td><input type="text" name="name" maxlength="50" style="width:400px; border: 1px solid #696969;" /><br /><br /></td>
</tr>
<tr>
<td class="required_field">*</td>
<td>Email Address</td>
<td><input type="text" name="email" maxlength="40" style="width:400px; border: 1px solid #696969;" /><br /><br /></td>
</tr>
<tr>
<td></td>
<td>Subject:</td>
<td><input type="text" name="subject" maxlength="40" style="width:400px; border: 1px solid #696969;"/><br /><br /></td>
</tr>
<tr>
<td class="required_field">*</td>
<td>Enter Image Code:</td>
<td><input type="text" value="" name="captext" style="width: 100px" maxlength="6" /></td>
</tr>
<tr>
<td></td>
<td><a onclick="refresh_security_image(); return false;" style="cursor:pointer;"><u>Refresh Image</u></a></td>
<td><img src="../includes/captcha.php" border="0" id="verificiation_image" /></a></td>
</tr>
</table>
<br/>
<p>
<input type="hidden" name="submited" value="1" />
<input type="submit" name="submit" value="Submit" style="margin:7px 10px 0px 0px; padding:10px 0px 10px 0px; font-size:15px; font-style:Century-Gothic;" />
</p>
</form>
</td>
</tr>
</table>
</div>
<script type="text/javascript">
<!--
function refresh_security_image() {

var new_url = new String("../includes/captcha.php?width=132&amp;height=36&charcators=");
new_url = new_url.substr(0, new_url.indexOf("width=") + 37);
// we need a random new url so this refreshes
var chr_str = "123456789";
for(var i=0; i < 6; i++)
new_url = new_url + chr_str.substr(Math.floor(Math.random() * 2), 1);
document.getElementById("verificiation_image").src = new_url;
}
-->
</script>

<!-- captch start -->
<script type="text/javascript" id="clientEventHandlersJS" language="javascript">
</script>
<!-- captch end -->

Thanks

Please feel free to use this code in any way if you need to:
I will appreciate any help in rewriting this code to improve it by showing ellipsis.

The way the code is now shows this:
Previous 1 2 3 4 5 6 7 8 9 10 Next

I would like some help in rewriting the code so that we can get an ellipsis and show something like this:
Previous 1 ... 4 5 6 7 ... 10 Next

Please post your improved version of this code (showing the ellipsis).
I would like for it to work when sorting as well thats why the ' &sort=' . $sort .  is included in the code.


Thank you in advance.




Code: [Select]
<?php
//Number of records from query to display per page
$display = 20 ;
       
//Write your code to sort in here and store it $sort

if ( isset($_GET['np'])) { // Already been determined.
       
        $num_pages = $_GET['np'];
       
        } else {
                //Now we count the number of records in the query
               
                $query = "SELECT COUNT(*) FROM postings ORDER BY posted_date DESC";
                $result = mysql_query($query);
                $row = mysql_fetch_array($result, MYSQL_NUM);
                $num_records = $row[0];
               
                //Now we calculate the number of pages
               
                if ($num_records > $display) {  //More than 1 page
                        $num_pages = ceil ($num_records/$display);
                } else {
                        $num_pages = 1;
                       
                       
                        }
               
               
                } // End of np IF
       
       
        //Determine where in the database to start returning results
       
        if (isset($_GET['s'])) {
                $start = $_GET['s'];
               
               
                } else {
                        $start = 0;
                       
                        }

     
           //Add code for query here
           $query = //whatever you need from the database tables

      while { // show the results from query here

        }

if ($num_pages > 1) {
                echo '<br /><p>' ;
               
                $current_page = ($start/$display) + 1 ;
               
                //If it is not the first page, then we make a previous button.
               
                if ($current_page != 1 ) {
                        echo ' <a href="viewpostings.php?s=' . ($start - $display) . '&np=' . $num_pages . ' &sort=' . $sort . '">Previous </a>';
                       
                        }
               
                //Make all the numbered pages.
               
                for ($i = 1; $i <= $num_pages; $i++) {
                       
                        if ($i != $current_page) {
                                echo '<a href="viewpostings.php?s=' . (($display * ($i - 1 ))) . '&np=' . $num_pages . ' &sort=' . $sort . '"> ' . $i . ' </a>';
                               
                                } else {
                                        echo $i. ' ';
                                       
                                       
                                        }
                       
                }
               
                //If it is not the last page, then we make a Next button;
                if ($current_page != $num_pages) {
                echo '<a href="viewpostings.php?s=' . ($start + $display) . '&np=' . $num_pages . ' &sort=' . $sort . '">Next</a>';
                }
                echo '</p>';
               
               
                }






?>

I am fairly comfortable with procedural PHP but when it comes to classes and OO I am learning.

I have written a small class to get all of the information from the URL. I am sure I have added my own style and broken about a million rules. I have already found places to improve this but I thought I would bounce it off everyone here before I started to make changes and started expanding it. I am also aware that there are classes that I can download that do this much better but I am trying to better understand how they work so I think this is a good start.

Can you just look it over and point out things that I have done wrong and give me some general pointers on how to improve it.
class uri extends mainframe{

private $path = null;

private $pathParse = array();

private $component = null;

private $view = null;

private $host = null;

private $dirDepth = null;

public  $queryString = array();

function __construct() {

$this->getHost();

$this->getPath();

$this->getView();

$this->getQueryString();
       

}

/*

 * Check to see if we are in the base folder

 */

function dirDepth($base) {

$this->dirDepth = config::DDEPTH + $base;

return $this->dirDepth;

}

/*

 * return the host address

 */

function getHost() {

$this->host = $_SERVER['HTTP_HOST'];

return $this->host;

}

/*

 * return the path information

 */

function getPath() {

$this->path = $_SERVER['REQUEST_URI'];

return $this->path;

}

/*

 * returns the query string in an array

 * 

 * I am sure this isn't the right way to do this

 * but it is working.

 */

function getQueryString() {

$this->getPath();

preg_match('/\?(.*)/', $this->path, $queryString);

if ($queryString == true) {

$queryPairs = array();

$queryString = (isset($queryString['1']) ? $queryString['1'] : null);

$queryPairs = explode('&', $queryString);

$queryStrings = array();

$pairs = array();

foreach ($queryPairs as $queryPairs) {

preg_match('/(.*)=(.*)/', $queryPairs, $pairs);

array_push($queryStrings, $pairs);

}

$key = array();

$value = array();

foreach ($queryStrings as $queryStrings) {

array_push($value, (isset($queryStrings['2']) ? $queryStrings['2'] : null));

array_push($key, (isset($queryStrings['1']) ? $queryStrings['1'] : null));

}

$this->queryString = array_combine($key, $value);

return $this->queryString;

}else{

unset($this->queryString);

}

}

/*

 * returns the path in an array and removes the query string

 */

function pathParse() {

self::getPath();

$this->pathParse = explode('/', $this->path);

$endCheck = preg_replace('/\?(.*)/','', array_pop($this->pathParse));

array_push($this->pathParse, $endCheck);

$this->pathParse = array_filter($this->pathParse);

if(!empty($this->pathParse)) {

return $this->pathParse;

}else{

unset($this->pathParse);

}

}

/*

 * returns the first part of the path

 */

function getComponent() {

self::pathParse();

self::dirDepth('1');

if(!empty($this->pathParse[$this->dirDepth])) {

$this->component = $this->pathParse[$this->dirDepth];

return $this->component;

}else{

unset($this->component);

}

}

/*

 * returns the second part of the path

 */

function getView() {

self::pathParse();

self::dirDepth('2');

if(!empty($this->pathParse[$this->dirDepth])) {

$this->view = $this->pathParse[$this->dirDepth];

return $this->view;

}else{

unset($this->view);

}

}

/*

 * Ummmmm need some help here for sure.

 */

function __destruct() {

}
}

$uri = new uri();

Thank you in advance for your help!

Hi Guys,

I have a simple PHP search facility (Below this post) for my customer system which uses a input form so users enter a customers name/telephone/address and it echos the result.

Its great but I observed as my customer table got bigger the search got less accurate, what i mean is when you search for mr test is give ur mr test along with mr andy and ms danielle.

Its ok but those any know how to make my search code better or can y'all help me with a better php search script.

Thanks.


<?php $query=$_GET['query'];
$query= str_replace("'","",$query);
 
// Change the fields below as per the requirements 
$db_host="localhost";
$db_username="root";
$db_password="";
$db_name=""; 
$db_tb_name="customer"; 
$db_tb_atr_name="c_name"; 
$query= str_replace("'","",$query);
//Now we are going to write a script that will do search task 
       // leave the below fields as it is except while loop, which will display results on screen 

mysql_connect("$db_host","$db_username","$db_password");
  mysql_select_db("$db_name"); 

$query_for_result=mysql_query("SELECT * FROM customer WHERE c_name like '%".$query."%' OR c_telephone like '%".$query."%' OR c_address like '%".$query."%'");
while($row=mysql_fetch_assoc($query_for_result)) { 
 $c_id = $row['c_id'];
 $c_name = $row["c_name"];
 $c_address = $row["c_address"];
 $c_postcode = $row["c_postcode"];
 $c_city = $row["c_city"];
 $c_telephone = $row["c_telephone"];
 $c_email = $row["c_email"];
 $salesman = $row["salesman"];
 echo '<table width="100%" border="0">
                  <tr>
                    <td><a href="customers.php?id=' . $c_id . '"> ' . $c_name . '</a> -
                    ' . $c_address . ' - ' . $c_city . ' - ' . $c_telephone . '&bull; <a href="customer_edit_index.php?pid=' . $c_id . '">edit</a><br /><br/></td>
                  </tr>
                </table>';
}  
                                mysql_close(); ?>

I have a download youtube site http://downloadvideoasmp3.com/
I would like to review an tell me what can be done to be improved.

I have started learning OOP, by following a few tutorials, My problem with most tutorial is they show you how, but don't tell you the what and the why. It's all good an well seeing what to do, but if you have no idea why it's being done, you don't learn much. I started a tutorial on Udemy but am not actually gaining a lot from it. I want to alter the code so that it will do it the way I want it to.

I am not wanting you to write the code for me, if you do please explain it so that I can understand the logic, preferably show me where to make changes and point me at the php tutorial that can solve my problem. I have been trying to solve this for a couple of weeks now, I tried a few things but none worked. 

The full followLinks function
 

function followLinks($url) {
	global $alreadyCrawled;
	global $crawling;
	$host = parse_url($url)["host"];
		
	$parser = new DomDocumentParser($url);
	
	$linkList = $parser->getLinks();

	foreach($linkList as $link) {
		$href = $link->getAttribute("href");
		
		if((substr($href, 0, 3) !== "../") AND (strpos($href, $host) === false)) {
			continue;
		}
		else if(strpos($href, "#") !== false) {
			continue;
		}
		else if(substr($href, 0, 11) == "javascript:") {
			continue;
		}

		// I need to change this below somehow, the two arrays are identical, 
		// What I want to do is move $href(crawled) to $alreadyCrawled  and remove it from $crawling
		// I also want to check if the current $href (crawling) is in $alreadyCrawled and if it is skip crawling and move on to the next one.
		
		//In essence I want to prevent the crawler from crawling anything already crawled in order to speed up the crawler.

		$href = createLink($href, $url);

		if(!in_array($href, $alreadyCrawled)) {
			$alreadyCrawled[] = $href;
			$crawling[] = $href;
		} else { continue;}

		

		echo $href . "<br>";
		
	}

	array_shift($crawling);

	foreach($crawling as $site) {	 		 		
	   followLinks($site); 
	} 	

}

$startUrl = "https://imagimedia.co.za";
followLinks($startUrl);
?>

Result.

From the ../blogs page there should be at least 20 more entries, that are not being listed. can anyone tell me why? 

 

https://imagimedia.co.za/../seo/
https://imagimedia.co.za/../pages/marketing.html
https://imagimedia.co.za/../pages/web-design.html
http://imagimedia.co.za/
https://imagimedia.co.za/../website-cost-quote.php
https://imagimedia.co.za/../blogs/history.html
https://imagimedia.co.za/../blogs/payment.html
https://imagimedia.co.za/../blogs/copy.html
https://imagimedia.co.za/../blogs/cycle.html
https://imagimedia.co.za/../blogs/information.html
https://imagimedia.co.za/../blogs/privacy.html
https://imagimedia.co.za/../blogs/terms.html
https://imagimedia.co.za/../blogs/content-is-king.html
https://imagimedia.co.za/../blogs/pretoria-north-web-design.html
https://imagimedia.co.za/../blogs/annlin-web-design.html
https://imagimedia.co.za/../blogs/
http://imagimedia.co.za
http://imagimedia.co.za/../seo/
http://imagimedia.co.za/../pages/marketing.html
http://imagimedia.co.za/../pages/web-design.html
http://imagimedia.co.za/../website-cost-quote.php
http://imagimedia.co.za/../blogs/history.html
http://imagimedia.co.za/../blogs/payment.html
http://imagimedia.co.za/../blogs/copy.html
http://imagimedia.co.za/../blogs/cycle.html
http://imagimedia.co.za/../blogs/information.html
http://imagimedia.co.za/../blogs/privacy.html
http://imagimedia.co.za/../blogs/terms.html
http://imagimedia.co.za/../blogs/content-is-king.html
http://imagimedia.co.za/../blogs/pretoria-north-web-design.html
http://imagimedia.co.za/../blogs/annlin-web-design.html
http://imagimedia.co.za/../blogs/

I know I am also going to have to exclude duplicates created by the http and https pages. But that is not my main issue.