[RESOLVED] More boring md5 questions.

[Smeep]

Ok, I have a simple registration form, which md5's the password.

Now I'm trying to make it so user can login, however, the passwords obvisiously don't match, as the password is encrypted. I tried putting md5( ) around the $password variables in my script, but as I've just learned what md5 is just now, I'm not sure that I'm doing it right.

The long and short of it is, users can't login, they get the login faile error. Here's my script

if (!@mysql_select_db('smeep')) {
 exit('Unable to locate the ' .
     'database at this time.');
} 

if ((!isset($_POST['username'])) || (!isset($_POST['password']))){
    echo 'Username or Password Incorrect';
    exit();
 }
else
 {
$username = $_POST['username'];
$password = md5($_POST['password']);  

$query = "SELECT password FROM webfriends WHERE username ='$username'";

		$result = mysql_query($query);
		if (!$result)
		 {
			 echo 'Username or Password Incorrect';
			 }
			else
		   {
			 	$password = mysql_result($result, 0, 'password');
				if ($password == md5($_POST['password']))
				{

				 setcookie ("wfcookie", "you are logged in", time()+3600);  


					echo 'login success <br />';
					echo 'attemtping to redirect <br />';
					echo '<p>Click <a href=http://www.webfriends.biz>here</a> if you do not wish to wait</p>';
					header("Location: http://www.webfriends.biz"); /* Redirect browser */

				}
				else
				{
					echo 'login failed';
			 }

			 }
			}
?>

[mchip]

echo $password and md5($_POST['password']) and see what the values are

[bpat1434]

Well, I see a couple things:
1.) You first set $password to the hashed value of $_POST['password'], then set it to the query result value
2.) You redirect using the header after information has been sent to the browser (that will result in an error)

Okay, so you can remove the line that says: $password = md5($POST['password']) since it's being overwritten later in your script. Then, it is possible to do this all in the query:

"SELECT * 
FROM webfriends 
WHERE username='$username' 
     AND password=MD5('".$_POST['password']."')
LIMIT 1"

Then, if the query fails, or returns no rows, you have an invalid login; otherwise that user was found and the passwords match. This is subject to SQL Injection hackign attempts, but you can get around that if need be.

But definately echo the values of the $password variable and md5($_POST['password']) since I'm guessing they're only slightly off....

~Brett

[Smeep]

Thanks for telling me to echo the values, I found the problem!

Simple fact was that I wasn't allowing enough storage space in my DB, so the hashed value of the password didn't fit in! Hense, the password was wrong!

Thanks again!