password security

Muses

Need help with making this more secure. I know md5 is probably how I need to do this but unsure on how to go about it.

Pretty sure I use
$password = md5($password);
but not sure where it goes and how it works.


// This is the login page for the site.

require_once ('incl/config.inc'); 
// Set the page title and include the HTML header.
$page_title = 'Login';
include ('incl/header.html');

if (isset($_POST['submit'])) { // Check if the form has been submitted.

require_once ('../mysql_connect.php'); // Connect to the database.

if (empty($_POST['username'])) { // Validate the username.
	$u = FALSE;
	echo '<p>You forgot to enter your username!</p>';
} else {
	$u = escape_data($_POST['username']);
}

if (empty($_POST['password'])) { // Validate the password.
	$p = FALSE;
	echo '<p>You forgot to enter your password!</p>';
} else {
	$p = escape_data($_POST['password']);
}

if ($u && $p) { // If everything's OK.

	// Query the database.
	$query = "SELECT user_id, username FROM user WHERE username='$u' AND password=PASSWORD('$p')";		
	$result = @mysql_query ($query);
	$row = mysql_fetch_array ($result, MYSQL_NUM); 

	if ($row) { // A match was made.

			// Start the session, register the values & redirect.
			$_SESSION['username'] = $row[1];
			$_SESSION['user_id'] = $row[0];

			ob_end_clean(); // Delete the buffer.

			header ("Location:  [url]http://[/url]" . $_SERVER['HTTP_HOST'] . dirname($_SERVER['PHP_SELF']) . "/index.php");
			exit();

	} else { // No match was made.
		echo '<p>The username and password entered do not match those on file.</p>'; 
	}

	mysql_close(); // Close the database connection.

} else { // If everything wasn't OK.
	echo '<p>Please try again.</p>';		
}

} // End of SUBMIT conditional.

<table align=center width=100% border="1" bordercolor="#8080C0">
<tr><td align=center background="img/nav_bg.jpg">Login </td></tr>
</table>
<p>Your browser must allow cookies in order to login.</p>

// The Form.
<form action="<?php echo $SERVER['PHP_SELF']; ?>" method="post">
<fieldset>
<p><b>User Name:</b> <input type="text" name="username" size="10" maxlength="20" value="<?php if (isset($POST['username'])) echo $_POST['username']; ?>" /></p>
<p><b>Password:</b> <input type="password" name="password" size="20" maxlength="20" /></p>
<div align="center"><input type="submit" name="submit" value="Login" /></div>
</form>

 // Include the HTML footer.
include ('incl/footer.html');

Nixon

Hi,

Yes to encode in md5, you want to encode the password to md5 on registration, add the password to your database as md5, then when a user logs in convert the password they used to log in, into md5 and compare the two.

Hope this helps!

Nixon.

Weedpacket

I don't know what hash function MySQL uses for PASSWORD, but it's not MD5 (if it was, MySQL wouldn't offer an MD5 function as well, even if MySQL's funky nonstandard string-handling conventions are suspected of causing it to mangle MD5 hashes....).

If you're using PASSWORD when you insert the password into the database originally, you shouldn't be needing to do anything more. Lobbing an MD5 in won't be likely to improve security significantly (unless PASSWORD is particularly broken).

Muses

Well I want to improve the security as best as I can. This site isnt live yet so I have time to tweak it as much as I can.

If I need to add this to my register script how would I do it with the following code and then include it in the login script?

registration.php


// This is the registration page for the site.
require_once ('incl/config.inc'); 

// Set the page title and include the HTML header.
$page_title = 'Register';
include ('incl/header.html');

if(isset($_POST['submit'])){// handle the form

// Connect to the database.
require_once ('../mysql_connect.php');

// Check for a first name.
	if (eregi ("^[[:alpha:].' -]{2,25}$", stripslashes(trim($_POST['first_name'])))) {
		$fn = escape_data($_POST['first_name']);
	} else {
		$fn = FALSE;
		echo '<p>Please enter your first name!</p>';
	}

// Check for a last name.
if (eregi ("^[[:alpha:].' -]{2,25}$", stripslashes(trim($_POST['last_name'])))) {
	$ln = escape_data($_POST['last_name']);
} else {
	$ln = FALSE;
	echo '<p>Please enter your last name!</p>';
}

// Check for an email address.
if (eregi ("^[[:alnum:]][a-z0-9_.-]*@[a-z0-9.-]+\.[a-z]{2,4}$", stripslashes(trim($_POST['email'])))) {
	$e = escape_data($_POST['email']);
} else {
	$e = FALSE;
	echo '<p>Please enter a valid email address!</p>';
}


// Check for a biography.
if (eregi ("^[[:alpha:].' -]{2,}$", stripslashes(trim($_POST['biography'])))) {
	$b = escape_data($_POST['biography']);
} else {
	$b = FALSE;
	echo '<p>Please enter your biography!</p>';
}

// Check for a interests.
if (eregi ("^[[:alpha:].' -]{2,}$", stripslashes(trim($_POST['interests'])))) {
	$i = escape_data($_POST['interests']);
} else {
	$i = FALSE;
	echo '<p>Please enter your interests!</p>';
}

// Check for a occupation.
if (eregi ("^[[:alpha:].' -]{2,}$", stripslashes(trim($_POST['occupation'])))) {
	$o = escape_data($_POST['occupation']);
} else {
	$o = FALSE;
	echo '<p>Please enter your occupation!</p>';
}


// Check for a username.
if (eregi ("^[[:alnum:]_]{4,20}$", stripslashes(trim($_POST['username'])))) {
	$u = escape_data($_POST['username']);
} else {
	$u = FALSE;
	echo '<p>Please enter a valid username!</p>';
}

// Check for a password and match against the confirmed password.
if (eregi ("^[[:alnum:]]{4,16}$", stripslashes(trim($_POST['password1'])))) {
	if ($_POST['password1'] == $_POST['password2']) {
		$p = escape_data($_POST['password1']);
	} else {
		$p = FALSE;
		echo '<p>Your password did not match the confirmed password!</p>';
	}
} else {
	$p = FALSE;
	echo '<p>Please enter a valid password!</p>';
}

if ($fn && $ln && $e && $b && $i && $o && $u && $p) { // If everything's OK.

	// Make sure the username is available.
	$query = "SELECT user_id FROM user WHERE username='$u'";		
	$result = @mysql_query ($query);

	if (mysql_num_rows($result) == 0) { // Available.

		// Add the user.
$full_date = $month . " " . $day . " " . $year;

$query = "INSERT INTO user (username, first_name, last_name, full_date, location, email, homepage, biography, interests, occupation, password,  registration) VALUES ('$u', '$fn', '$ln', '$full_date','$location', '$e', '$homepage', '$b', '$i', '$o', PASSWORD('$p'), NOW() )";		
		$result = @mysql_query ($query); // Run the query.

		if ($result) { // If it ran OK.

			// Send an email, if desired.
			echo 'Thank you for registering!';
			include ('incl/footer.html'); // Include the HTML footer.
			exit();				

		} else { // If it did not run OK.
			// Send a message to the error log, if desired.
			echo '<p>You could not be registered due to a system error. We apologize for any inconvenience.</p>'; 
		}		

	} else { // The username is not available.
		echo '<p>That username is already taken.</p>'; 
	}

	mysql_close(); // Close the database connection.

} else { // If one of the data tests failed.
	echo '<p>Please try again.</p>';		
}

} // End of the main Submit conditional.

Muses

<table align=center width=100% border="1" bordercolor="#8080C0">
<tr><td colspan=2 background="img/nav_bg.jpg" align=center valign=middle>
User Registration Form</td></tr>
</table>

<p>By registering you are agreeing to the Dreamers' Athenaeum <a href="terms.php">Terms of Use</a>.</p>

<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">

<tr>
<td width=20%>First Name:</td>
<td><input type="text" name="first_name" size="20" maxlength="25" value="<?php if (isset($POST['first_name'])) echo $POST['first_name']; ?>" /></td>
</tr>

<TR>
<TD>Birthdate</td>
<TD>
<select name="month">
<option>January
<option>February
<option>March
<option>April
<option>May
<option>June
<option>July
<option>August
<option>September
<option>October
<option>November
<option>December
</select>

</td>
</tr>

<tr>
<td>Location:</td>
<td>
<select name="location">
<option>No country</option>
<option>Argentina</option>
<option>Australia</option>
<option>Austria</option>
<option>Belgium</option>
<option>Bosnia</option>
<option>Brazil</option>
<option>Bulgaria</option>
<option>Canada</option>
<option>Chile</option>
<option>Croatia</option>
<option>Cyprus</option>
<option>Czechoslavakia</option>
<option>Denmark</option>
<option>England</option>
<option>Finland</option>
<option>France</option>
<option>Georgia</option>
<option>Germany</option>
<option>Greece</option>
<option>Holland</option>
<option>Hong Kong</option>
<option>Hungary</option>
<option>Iceland</option>
<option>India</option>
<option>Indonesia</option>
<option>Iran</option>
<option>Iraq</option>
<option>Ireland</option>
<option>Israel</option>
<option>Italy</option>
<option>Japan</option>
<option>Leichenstein</option>
<option>Luxembourg</option>
<option>Malaysia</option>
<option>Malta</option>
<option>Mexico</option>
<option>Morocco</option>
<option>New Zealand</option>
<option>North Vietnam</option>
<option>Norway</option>
<option>Poland</option>
<option>Portugal</option>
<option>Puerto Rico</option>
<option>Qatar</option>
<option>Rumania</option>
<option>Russia</option>
<option>Scotland</option>
<option>Singapore</option>
<option>South Africa</option>
<option>Spain</option>
<option>Sweden</option>
<option>Switzerland</option>
<option>Turkey</option>
<option>United Kingdom</option>
<option>United States</option>
</select>
</td>
</tr>

<tr>
<td>Email Address:</td>
<td><input type="text" name="email" size="40" maxlength="40" value="<?php if (isset($POST['email'])) echo $POST['email']; ?>" /></td>
</tr>

<tr>
<td>Homepage:</td>
<td><input type="text" name="homepage" size="50" maxlength="50" value="<?php if (isset($POST['homepage'])) echo $POST['homepage']; ?>" /></td>
</tr>

<tr>
<td> Biography:</td>
<td><textarea name="biography" cols="50" rows="15" value="<?php if (isset($POST['biography'])) echo $POST['biography']; ?>" /></textarea>
</td>
</tr>

<tr>
<td> Interests:</td>
<td><textarea name="interests" cols="50" rows="5" value="<?php if (isset($POST['interests'])) echo $POST['interests']; ?>" /></textarea>
</td>
</tr>

<tr>
<td height="47">Occupation:</td>
<td><input type="text" name="occupation" size="50" maxlength="50" value="<?php if (isset($POST['occupation'])) echo $POST['occupation']; ?>" /></td>
</tr>

<tr>
<td>User Name:</td>
<td><input type="text" name="username" size="20" maxlength="20" value="<?php if (isset($POST['username'])) echo $POST['username']; ?>" /><br/><small>Use only letters, numbers, and the underscore. Must be between 4 and 20 characters long.</small></td>
</tr>

<tr>
<td>Password:</td>
<td><input type="password" name="password1" size="20" maxlength="20" /><br/><small>Use only letters and numbers. Must be between 4 and 16 characters long.</small></td>
</tr>

<tr>
<td>Confirm Password:</p></td>
<td><input type="password" name="password2" size="20" maxlength="20" /></td>
</tr>

</form><!-- End of Form -->

 // Include the HTML footer file.
include_once ('incl/footer.html');