encryption/decryption scenario....

[Anon]

Hi guys
I need to let a handful of users enter a specific section in site. It's just an admin script that will allow them to edit/enter content on there site.

I'd like to use a simple encrypt/decrypt style login using MySQL.

I've done all the work, but I'm not sure what functions to use for this.

I'm not sure what my ISP has installed either.

Any help appresiated!

Nick

[Anon]

You can use the encode/decode functions built into MySQL.

http://www.mysql.com/doc/M/i/Miscellaneous_functions.html

A more secure way to authenticate is to store the password(s) in the database hashed with MD5 or SHA1 and then hash what they type into the form and compare the two hashed passwords to validate.

[Anon]

Yeah but md5's one way right?

[kparker]

md5() is indeed one way, but that's great for passwords: store the hashed version, hash the incoming password and compare it to the retrieved hashed version. No need for plaintext or decryption at all...

[Anon]

Okay, I'll go with that. The reason I mentioned the one way thing was that I thought I ought to provide a "lost your password?" feature.
I guess that's probably a little overkill though as it's meant to be used by two or threee people at the max.

Thanks a lot guys

Nick

[mithril]

Nick,

If you look in the PHP Manual Errata for the md5() function, there's an example there that hashes a string using a pre-set key. The hash can then be decrypted and the string returned as plain-text once more. You could set the code up to use the username as the key and hash the password of it. Thus each key remains constant, but is unique to each user. HTH.

Geoff A. Virgo