MD5盐登录系统

Question

Hey guy's i'm trying to make a login system which uses MD5 encryption for the password. I have the encrypting to work and all it's just for some reason when i enter the password "palmer" into the login page and click the login button i made it send me to a page where it tells me encrypted password and using "palmer" as the password it outputs this "Duncan Logged in using password 4844fd4088ef5278ad18f892808ebda8 - palmer". THe password in the database when encrypted is "4669a6b46c8d891b373cfcd664dff6". Why are the two passwords different? I am using the same Salt(the salt is "a123b123".

Below is my code which encrypts password on register:

$password = $_POST['password'];

$md5pass = md5($salt.md5($password));

Below is my login code.

<?php
session_start();
include('config/config.php');

$email = $_POST['email'];
$password = $_POST['password'];
$pass2 = md5($salt.md5($password));

$check = mysql_query("SELECT `email`,`password` FROM user WHERE (`email`='$email' AND       `password`='$pass2')") or die(mysql_error());

$count = mysql_num_rows($check);

//if($count == 1) {
$_SESSION['user'] = strtoupper($user);
//header('Location: /panel/index.php');
echo("Duncan Logged in using password $pass2 - $pass");
//} else {
//$_SESSION['errormsg'] = "<div id='error'><strong>Error:</strong> Invalid Username or Password!</div>";
//header('Location: index.php');
//}
?>

Answer 1

you have to store your salt – and please, use a random salt, this way two users with the same password will get a different digest: – somewhere for later use:

$salt = sha1(getRandomSalt());
$digest = sha1($password.$salt).'$'.$salt; // use sha1 instead of md5

later you can check the provided password with the same salt:

list($stored_pw, $stored_salt) = explode('$', $stored_digest);
if($stored_pw == sha1($user_provided_pw.$stored_salt)) {
  echo 'user provided correct password';
}

Answer 2

You should really use bcrypt for this. There is more on bcrypt on previous Stack Overflow post How do you use bcrypt for hashing passwords in PHP?

bcrypt is considered the most secure way to implement password hashing with salt because it is slow - much slower than an MD5.

Answer 3

Just a little comment to knittl's solution from above:

You need to replace the line

if($stored_pw = sha1($user_provided_pw.$stored_salt)) {

by

if($stored_pw == sha1($user_provided_pw.$stored_salt)) {

to get it working.

(I tried to add it to knittl's post, but it says edits need to be at least 6 characters long)