Adding Password in MD5

[NZ_Kiwi]

Hey everyone..

i have this code which works fine, but i want the password to add in MD5 format, how do i do this

<?php 

$check = "select id from members where username = '".$_POST['username']."';"; 
$qry = mysql_query($check) or die ("Could not match data because ".mysql_error());
$num_rows = mysql_num_rows($qry); 
if ($num_rows != 0) { 
echo "Sorry, the username $username is already taken. Please go back and try another.<br>";



} else {

$result = mysql_query("insert into members (`id`,`username`,`firstname`,`lastname`,`dob`,`address`,`city`,`country`,`phone`,`email`,`password`,`nz_mailing`,`active`,`warriors_mailing`,`bcc_mailing`,`level`) values ('', '".$_POST['username']."','$firstname','$lastname','$dob','$address','$city','$country','$phone','$email','".$_POST['password']."','$nz_mailing','$active','$warriors_mailing','$bcc_mailing','$level')")
or die("Could not insert data because ".mysql_error());

print ("Thanks for registering with [url]www.rugbyleaguenz.com[/url] <?php echo $firstname ?> , we have sent you a email with instructions 
          on how to activate your account.");

}

?> 

this is my auth page for the record

<?php
	session_start();
	// dBase file
	include "dbConfig.php";

if ($_GET["op"] == "login")
	{
	if (!$_POST["username"] || !$_POST["password"])
		{
		Header("Location: error.php");
		}

	// Create query
	$q = "SELECT * FROM `members` "
		."WHERE `username`='".$_POST["username"]."' "
		."AND `password`=PASSWORD('".$_POST["password"]."') "
		."LIMIT 1";
	// Run query
	$r = mysql_query($q);

	if ( $obj = @mysql_fetch_object($r) )
		{
		// Login O.K., create session variables
		$_SESSION["valid_id"] = $obj->id;
		$_SESSION["valid_user"] = $_POST["username"];
		$_SESSION["valid_time"] = time();

		// Redirect to member page
		Header("Location: members.php");
		}
	else
		{
		// Login not successful
		Header("Location: error.php");
		}
	}
else
	{
	Header("Location: error.php");
	}
?>

[gaucho]

Hello NZ_KIWI,

you must pass the password from login page (<input type='password' name='pw' value=''> //or similar) to the md5() function.

$db_pw = $md5($pw);

now do the query with $db_pw.

cheers

gaucho

[NZ_Kiwi]

Originally posted by gaucho
Hello NZ_KIWI,

you must pass the password from login page (<input type='password' name='pw' value=''> //or similar) to the md5() function.

$db_pw = $md5($pw);

now do the query with $db_pw.

cheers

gaucho

ok i added it in like this

 
<?php  

$check = "select id from members where username = '".$_POST['username']."';";  

$qry = mysql_query($check) or die ("Could not match data because ".mysql_error()); 
$num_rows = mysql_num_rows($qry);  

if ($num_rows != 0) {  

echo "Sorry, the username $username is already taken. Please go back and try another.<br>"; 



} else { 

$result = mysql_query("insert into members  (`id`,`username`,`firstname`,`lastname`,`dob`,`add
ress`,`city`,`country`,`phone`,`email`,`password`,
`nz_mailing`,`active`,`warriors_mailing`,`bcc_mail
ing`,`level`) values ('', '".$_POST['username']." ','$firstname','$lastname','$dob','$address','$cit
y','$country','$phone','$email','".$_POST['password']." ','$nz_mailing','$active','$warriors_mailing','$bc
c_mailing','$level')") 
or die("Could not insert data because ".mysql_error()); 

print ("Thanks for registering with <a href="http://www.rugbyleaguenz.com" target="_blank">[url]www.rugbyleaguenz.com[/url]</a> <?php echo $firstname ?> , we have sent you a email with instructions 
          on how to activate your account."); 

} 

?> 

Fatal error: Call to undefined function: () in /home/httpd/vhosts/rugbyleaguenz.com/httpdocs/members/confirm.php on line 97

[NZ_Kiwi]

Originally posted by NZ_Kiwi
ok i added it in like this, also the text box has a name of pw and type is password

 
<?php  

$check = "select id from members where username = '".$_POST['username']."';";  

$qry = mysql_query($check) or die ("Could not match data because ".mysql_error()); 
$num_rows = mysql_num_rows($qry);  

if ($num_rows != 0) {  

echo "Sorry, the username $username is already taken. Please go back and try another.<br>"; 



} else { 
$password = $md5($pw); 

$result = mysql_query("insert into members  (`id`,`username`,`firstname`,`lastname`,`dob`,`add
ress`,`city`,`country`,`phone`,`email`,`password`,
`nz_mailing`,`active`,`warriors_mailing`,`bcc_mail
ing`,`level`) values ('', '$username']." ','$firstname','$lastname','$dob','$address','$cit
y','$country','$phone','$email','$password','$nz_mailing','$active','$warriors_mailing','$bc
c_mailing','$level')") 
or die("Could not insert data because ".mysql_error()); 

print ("Thanks for registering with <a href="http://www.rugbyleaguenz.com" target="_blank">[url]www.rugbyleaguenz.com[/url]</a> <?php echo $firstname ?> , we have sent you a email with instructions 
          on how to activate your account."); 

} 

?> 

Fatal error: Call to undefined function: () in /home/httpd/vhosts/rugbyleaguenz.com/httpdocs/members/confirm.php on line 97 [/B]

[gaucho]

Sorry,

little error I produced, I'm already about 24 hours awake.

it must be like this:

$db_pw = md5($pw);
//instead of
$db_pw = $md5($pw);

md5 is a function.

cheers

gaucho

[fredouille]

not need to put some password in md5..your code if full of security holes..no filter on get and post...it is possible to hacker the systeme very easy

[TheBB]

Besides, you seem to have messed up with the quote marks here...

print ("Thanks for registering with <a href="http://www.rugbyleaguenz.com" target="_blank"><a href="http://www.rugbyleaguenz.com" target="_blank">[url]www.rugbyleaguenz.com[/url]</a></a> <?php echo $firstname ?> , we have sent you a email with instructions 
          on how to activate your account.");

[NZ_Kiwi]

Originally posted by gaucho
Sorry,

little error I produced, I'm already about 24 hours awake.

it must be like this:

$db_pw = md5($pw);
//instead of
$db_pw = $md5($pw);

md5 is a function.

cheers

gaucho [/B]

Ok, I've just worked out my other.php form adds the password in SQL hassing format.... how do i set that up for my signupadd.php page... does anyone know?

signupadd.php

<html>

<head>
<style type="text/css">



<!-- A:link, A:visited { text-decoration: none }



A:hover { COLOR: BLACK; text-decoration: underline } -->



</style>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<meta http-equiv="Content-Language" content="en-nz">
<title>Rugby League in New Zealand</title>
<meta name="keywords" content="New Zealand Warriors, New Zealand Kiwis, New Zealand Rugby League, Rugby League, Bartercard Cup">
<meta name="description" content="Rugby League in New Zealand from th grass roots to the Warriors and the Kiwis.">
</head>

<link rel="stylesheet" type="text/css" href="http://localhost/includes/rugbyleaguenz.css">
<body bgcolor="#C0C0C0" topmargin="1" leftmargin="1" marginwidth="1" marginheight="1">

<div align="center">
 <table border="1" cellspacing="0" style="border-collapse: collapse" width="765" id="table1" bgcolor="#000000">
  <tr>
   <td>
   <table border="0" style="border-collapse: collapse" width="100%" id="table2" cellpadding="0">
    <tr>
     <td>
     <table border="0" style="border-collapse: collapse" width="100%" id="table4">
      <tr>
       <td><?php 



require("../includes/header.php"); 



?></td>
      </tr>
      <tr>
       <td><?php 



require("../includes/menu.php"); 



?> </td>
      </tr>
     </table>
     </td>
    </tr>
    <tr>
     <td>
     <table border="0" style="border-collapse: collapse" width="100%" id="table3">
      <tr>
       <td width="150" align="left" valign="top"><?php 



require("../includes/leftmenu.php"); 



?> </td>
       <td bgcolor="#FFFFFF">&nbsp;<hr color="#000000" width="97%" size="1">
       <div align="center">
        <table border="0" style="border-collapse: collapse" width="97%" id="table5">
         <tr>
          <td><font face="Verdana" size="2">

<?php
mysql_connect (localhost, user, pass);
mysql_select_db (table);
?>

<?php 

$check = "select id from members where username = '".$_POST['username']."';"; 
$qry = mysql_query($check) or die ("Could not match data because ".mysql_error());
$num_rows = mysql_num_rows($qry); 
if ($num_rows != 0) { 
echo "Sorry, the username ".$_POST['username']."' is already taken. Please go back and try another.<br>";



} else {





$result = mysql_query("insert into members (`id`,`username`,`firstname`,`lastname`,`dob`,`address`,`city`,`country`,`phone`,`email`,`password`,`nz_mailing`,`active`,`warriors_mailing`,`bcc_mailing`,`level`) values ('', '$username','$firstname','$lastname','$dob','$address','$city','$country','$phone','$email','$password','$nz_mailing','$active','$warriors_mailing','$bcc_mailing','$level')")
or die("Could not insert data because ".mysql_error());

print ("Thanks for registering with [url]www.rugbyleaguenz.com[/url] <?php echo $firstname ?> , we have sent you a email with instructions 
          on how to activate your account.");

}

?> 

</font>
          </td>
         </tr>
        </table>
       </div>
       <hr color="#000000" width="97%" size="1">
       <p align="center"><?php 



require("../includes/footer.php"); 



?> </p>
       </td>
       <td width="150" align="right" valign="top"><?php 



require("../includes/rightmenu.php"); 



?></td>
      </tr>
     </table>
     </td>
    </tr>
   </table>
   </td>
  </tr>
 </table>
</div>

</body>

</html>

.

other page

<?php

// dbConfig.php is a file that contains your
// database connection information. This
// tutorial assumes a connection is made from
// this existing file.
include ("dbConfig.php");


// ==== Input validation and PHP dBase code ===============================
//
// ========================================================================

if ( $_GET["op"] == "reg" )
	{
	$bInputFlag = false;
	foreach ( $_POST as $field )
		{
		if ($field == "")
			{
			$bInputFlag = false;
			}
		else
			{
			$bInputFlag = true;
			}
		}
	// If we had problems with the input, exit with error
	if ($bInputFlag == false)
		{
		die( "Problem with your registration info. "
			."Please go back and try again.");
		}

	// Fields are clear, add user to database
	//  Setup query
	$q = "INSERT INTO `members` (`username`,`password`,`email`) "
		."VALUES ('".$_POST["username"]."', "
		."PASSWORD('".$_POST["password"]."'), "
		."'".$_POST["email"]."')";
	//  Run query
	$r = mysql_query($q);

	// Make sure query inserted user successfully
	if ( !mysql_insert_id() )
		{
		die("Error: User not added to database.");
		}
	else
		{
		// Redirect to thank you page.
		Header("Location: register.php?op=thanks");
		}
	} // end if



// ==== Thank you page ====================================================
// 
// ========================================================================
elseif ( $_GET["op"] == "thanks" )
	{
	echo "<h2>Thanks for registering!</h2>";
	}



// ==== Main Form =========================================================
//
// ========================================================================
else
	{
	echo "<form action=\"?op=reg\" method=\"POST\">\n";
	echo "Username: <input name=\"username\" MAXLENGTH=\"16\"><br />\n";
	echo "Password: <input type=\"password\" name=\"password\" MAXLENGTH=\"16\"><br />\n";
	echo "Email Address: <input name=\"email\" MAXLENGTH=\"25\"><br />\n";
	echo "<input type=\"submit\">\n";
	echo "</form>\n";
	}
// EOF
?>

[alexboyer]

$result = mysql_query("insert into members  (`id`,`username`,`firstname`,`lastname`,`dob`,`add
 ress`,`city`,`country`,`phone`,`email`,`password`,
 `nz_mailing`,`active`,`warriors_mailing`,`bcc_mail
ing`,`level`) values ('',  '$username','$firstname','$lastname','$dob','$addr
 ess','$city','$country','$phone','$email','$passwo
 rd','$nz_mailing','$active','$warriors_mailing','$
bcc_mailing','$level')") 

becomes

$encrypass=md5($password);
$result = mysql_query("insert into members  (`id`,`username`,`firstname`,`lastname`,`dob`,`add
 ress`,`city`,`country`,`phone`,`email`,`password`,
 `nz_mailing`,`active`,`warriors_mailing`,`bcc_mail
ing`,`level`) values ('',  '$username','$firstname','$lastname','$dob','$address','$city','$country','$phone','$email','$encrypass','$nz_mailing','$active','$warriors_mailing','$
bcc_mailing','$level')") 

[NZ_Kiwi]

Originally posted by alexboyer

$result = mysql_query("insert into members  (`id`,`username`,`firstname`,`lastname`,`dob`,`add
 ress`,`city`,`country`,`phone`,`email`,`password`,
 `nz_mailing`,`active`,`warriors_mailing`,`bcc_mail
ing`,`level`) values ('',  '$username','$firstname','$lastname','$dob','$addr
 ess','$city','$country','$phone','$email','$passwo
 rd','$nz_mailing','$active','$warriors_mailing','$
bcc_mailing','$level')") 

becomes

$encrypass=md5($password);
$result = mysql_query("insert into members  (`id`,`username`,`firstname`,`lastname`,`dob`,`add
 ress`,`city`,`country`,`phone`,`email`,`password`,
 `nz_mailing`,`active`,`warriors_mailing`,`bcc_mail
ing`,`level`) values ('',  '$username','$firstname','$lastname','$dob','$address','$city','$country','$phone','$email','$encrypass','$nz_mailing','$active','$warriors_mailing','$
bcc_mailing','$level')") 

[/B]

but it's not md5 is it? It's using MySQL password hashing

[planetsim]

md5 is only a hash its not encryption. I should suggest that you add a salt onto the md5(); otherwise its extremely possible to crack it there are sites dedicated out there now cracking md5 passwords