Encrypt passwords

chriskona

Can anyone give me a hand,

What im trying to do is.

I have 2 databases. 1 contains plain text passwords, I want to grap those passwords, than encrypt them, and insert them into the new table. Does anyone know how to encrypt the passwords using php?

cvincent

How do you want to encrypt them? You can use the crypt function with your own salt to make one way hashes. You could use base64 or uuencoding...

http://www.php.net/manual/en/function.crypt.php
http://www.php.net/manual/en/function.base64-encode.php
http://www.php.net/manual/en/ref.mhash.php

-Chris

chriskona

Kinda figured it out, after slaping myself with a wet noodle.

$password=mysql_result($result,$i,"password");

$newpass = crypt($password)

Now to figure out how to import it. Im doing a mass list about 500 or so.

Anon

i'm having problem with the encrypt() function. The error message is that i'm using illegal function. For your knowledge i'm using php3. i probably missed out something during installation of php. my os is Win98. please help

Anon

base64 is all well and good, but it is not the best security, as there is a decrypt function (base64_decode()) function right in PHP. Wouldn't take too long to crack a password if I got one in base64. It is, however good for sending emails or messages, where security is not TOO important, and can be easily decoded later. NOT FOR PASSWORDS, THOUGH.

Crypt is not built into all PHP, I would advise against using it, since I believe there is also decrypt() right in PHP again. NOT FOR PASSWORDS.

What is good for passwords, however, is md5().

http://www.php.net/manual/en/function.md5.php

If you're looking to convert members over, there is an easier way that dumping the database (coding wise).

On the new login, tell them to click a link if they have already registered. After clicking that link, they get sent to another login page (the converter).

Now, when they log in here, it checks their password in database1 with the un-encrypted password, if it's right, it then writes the new password, as well as other user data to database2 (encrypted passwords).

Note, though, that when using md5, you CAN NOT decrypt it. This means two things:

Do not forget a password, or have a script that can generate a new password if the user replies to an email or something.
Your login script that reads from database2 (encrypted) has to md5() before it checks with the database.