PHP x == x但是如果语句说x！= x

Question

I have a checklogin.php:

<?php

$host="localhost"; // Host name 
$username="user"; // Mysql username 
$password="pass"; // Mysql password 
$db_name="database1"; // Database name 
$tbl_name="users"; // Table name 
$lastLogDate=date("l, m/d/y, h:i:sa");
// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB");

// username and password sent from form 
$myusername=$_POST['myusername']; 
$mypassword=$_POST['mypassword']; 

// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);

$sql="SELECT password FROM $tbl_name WHERE username='$myusername'";
$result=mysql_query($sql);
$realpassword=mysql_result($result, 0);

define("ENCRYPTION_KEY", "!@#$%^&*");
function decrypt($encrypted_string, $encryption_key) {
    $iv_size = mcrypt_get_iv_size(MCRYPT_BLOWFISH, MCRYPT_MODE_ECB);
    $iv = mcrypt_create_iv($iv_size, MCRYPT_RAND);
    $decrypted_string = mcrypt_decrypt(MCRYPT_BLOWFISH, $encryption_key, $encrypted_string, MCRYPT_MODE_ECB, $iv);
    return $decrypted_string;
}
$realpassword=decrypt($realpassword, ENCRYPTION_KEY);

if ($mypassword == $realpassword) {
session_register("myusername");
session_register("mypassword"); 
session_register("userid");
session_register("finalemail");
$sqldate="UPDATE userdata SET lastLog = '$lastLogDate' WHERE username = '$myusername'";
$resultdate=mysql_query($sqldate);
header("location:/home");
}
else {
echo "Wrong Username or Password<br>";

}
?>

When someone logs in with login.php, and the password they entered is the same as the password in the database after the decryption, it still says "wrong username or password". I added an echo to see if the decryption was working, but it returned correctly. I made a new account and tried to log in with that, and it worked. This only doesn't work with accounts before I added encryption, and I just encrypted the passwords myself. Maybe that's the problem?

Answer 1

Your problem is two-fold.

First, mcrypt pads your data with trailing null bytes before encoding (if you don't apply padding yourself, eg PKCS7); after decoding you need to strip those null bytes:

$realpassword = rtrim($realpassword, "\0");

Second, you shouldn't use encryption for passwords; instead, use the password hashing API ; see this answer for an example.

Answer 2

maybe the old password affected by those transform:

$mypassword = stripslashes($mypassword);
$mypassword = mysql_real_escape_string($mypassword);