How to authenticate against a value stored with the MySQL ENCRYPT() function

mority

Hi board,

I'm stuck with the following task: I want to write a function which compares some user input to a value which is stored with the MySQL ENCRYPT() function in a database.

I read the MySQL documentation about the ENCRYPT() function and the documentation about the PHP crypt() function.

Both claim to use the crypt() UNIX system call, so I was happy, cause I thought I could do something like this:

if ($value_from_db == crypt($user_input)) user_is_valid();

But of course this doesn't work because I get different results when I use the ENCRYPT() function and the crypt() function on the same string. The UNIX manpage 'man 3 crypt' does not help me very much either, and as I'm really not an expert with this kind of stuff I am pretty stuck now.

The environment I am working on is a Debian 3.1 Sarge system with MySQL 5.0.24 and PHP 5.1.5.

I would very much appreciate it if anyone could point me into the right direction how to get the task done.

Thanks for reading.

nnichols

Is there any reason why you don't use the user value in your query?

SELECT col1, col2 FROM table_name WHERE encrypted_field = ENCRYPT($user_input)

or even just add ENCRYPT($user_input) as an extra field in your existing query

SELECT col1, col2, ENCRYPT($user_input) FROM table_name WHERE ...

or run a separate query to get the value

SELECT ENCRYPT($user_input)

mority

Hmm, first I thougt that would solve my problem so I did this:

$query = sprintf("SELECT ENCRYPT(%s)", quote_smart($pw));

But I get a different value back from the database for every call of the script. It must have to do something the "salt" which is random by default as the documentation for ENCRYPT() says. But the hell could I now what salt was used when the database entry originally was created??

nnichols

Your welcome. Remember to mark the thread as RESOLVED - if it is.