md5 Passwords

netmastan

User name and password are encrypted using md5 funcion before they store in the database .

Now, user forgot their password. So I want to send their password accroding to their email address . How do I send real password which was encrypted by md5 function.

daphreeek

md5() is an irreversible encryption so the only way to get the original password is to have a computer keep guessing a password, md5()ing it, and checking that against the database 🙂 sounds easy but will take a very very long time + lots of resources.

Its easier to reset the password and e-mail them that new password then md5() the new password and put that into the database. then when they get the email they just log in and change thier password 🙂

btw - where in auckland are u from? I live in albany 🙂

Matt

lnfreish

you can generate a random string as the new password, then use md5 encrypt it and update the database before you send a email to tell the member his/her new password.

nightowl

There is even some kind of tutorial on this on this site ... see the 'secure authentication' article of Tim Perdue, the founder of this great site !

netmastan

Thank you guys.... there is no problem in my script about authentication . I just wanted to know how to handle lost password things... better way.

I just checked how vb forum works.

Hello,

You have requested to reset your password on PHP Builder Community Forums forums
because you have forgotten your password. If you did not request this, please
ignore it. It will expire and become useless in 24 hours time.

To reset your password, please visit the following page:
[url]http://www.phpbuilder.com/board/member.php?a=pwd&u=123456&i=123456[/url]

When you visit that page, your password will be reset, and the new password will
be emailed to you.

Your username is:xxxxx

To edit your profile, go to this page:
[url]http://www.phpbuilder.com/board/member.php?action=editprofile[/url]

Yours,
PHP Builder Community Forums team

How do i delete record within 24 hours without using cron job ?

suntra

In the DB, put a field which contains the date when the password was "reseted". Also, create another field which contains the temporary password. Then, with Cron, you call a script (suppose every 10 minutes) which will "extract" all the rows containing a temporary password (the field is not empty) and will look at the date and will compare it with now (now - date), and if it's bigger than 24h (86 400s), you delete the temporary password and the date. Personnally, I would simply use microtime to be stored in the db. Use this : ereg_replace("^.* ", "", microtime());

Is it clear enough ??

netmastan

Thank you but I don't have permission to use cron ...

suntra

Then, when the user logs in and the delay is over, you delete the temporary password and the date, and you let the user log normally with his usual username and password. But if the delay is not over, you ask for the new password...