php crypt

[trevor]

i was wondering if someone could clarify the logic behind php crpyt();
i have it so when users register and enter a password it crypts it

PHP Code:

$cryptpass=$crypt($password); 


but for the login script....do i have to decrypt the password to authenticate it or hos does that work?
thanks,
Trevor

[sde]

i usually use md5() for encrypting. and the logic will work for crypt as well.

your not going to decrypt at all, but rather encrypt the password they enter, and compare it to the encrypted password stored in the database.

when you use md5() , it produces a 32 character string, and that is the string you would store in the database.

PHP Code:

<?
// lets say you had a form that passed username and password
$encrypted_password = md5($_POST['password']);

$result=mysql_query("select * from users 
             where username='" . $_POST['username'] . "' 
               and password='" . $encrypted_password . "'");

// if any rows were found then it was successful
?>

[idx]

To add a bit to sde's response, if you still want to use crypt(), then you must make sure you use the salt when you verify their login (see Example 1 http://www.php.net/crypt ). With md5 you don't have to think about this fact since the md5 hash will be the same everytime.

Also, when creating the crypt'ed version of the user's password, you really should be aware of what your server's capabilities are. eg: The default is standard DES (2chr salt), although for my FreeBSD box, PHP will produce a md5 signature with a 12chr salt. (not exactly the same md5 that sde is talking about)

More or less when using crypt, you should provide your own salt to ensure your password formats stay the same. It would suck to move your site to another server and have inconsistent password formats.

-r

(As a side note, I use md5 in projects where I don't have a specific reason to use crypt(). )

[sde]

thanks for explaining a little more about crypt idx!

i like md5, .. i develop c#/asp.net apps too, and can get the same hash from php or c#. with c# it's a lot more code though.