PHP md5密码不等于数据库md5密码

Question

So, I'm having this issue with my login script where the MD5 password stored in my MySQL database is decrypted and it will check if the password is equal to the one entered.

My code is as follows:

if(isset($_POST['btn-login']))
{
 $email = mysqli_real_escape_string($_POST['email']);
 $upass = mysqli_real_escape_string($_POST['pass']);
 $md5_pass = md5($upass);
 $res = mysqli_query($con, "SELECT * FROM users WHERE email='$email'");
 $row = mysqli_fetch_array($res, MYSQLI_ASSOC);
 if($row['password'] == $md5_pass)
 {
  $_SESSION['user'] = $row['user_id'];
  header("Location: profile.php");
 }
 else
 {  ?>
  <script>alert("Wrong details entered!");</script>
  <?php
 }

}

Answer 1

Both the md5() will be same. You must check your column datatype and number of characters limit.

Check whether your database is having encrypted value. Because you are comparing it with md5() value.

Answer 2

Don't escape before performing md5 on the query.

Ankii's reply can also solve the issue if you have a varchar which is too small.

Also, use a better hashing system (sha512?). Also, use salt.