[RESOLVED] MD5 passwords don't match.

[Chris_96_WS6]

Having a problem with a login script. User acct creation succesfully hashes and stores into the DB...but when I go to test the login the hashs don't match.

Here's the creation script:

// encrypt password
  $password_hash = md5($password);

  // insert a new record into DB
	$query4 = "INSERT INTO user (user_name, real_name, password, email, confirm_hash, is_confirmed) VALUES ('$user_name', '$real_name', '$password_hash', '$email', '$hash', '0');";
  $result = mysql_query($query4) or die ("Error in query4: $query4. " . mysql_error());

results in this hash: fdd10de968091fc68f82828acf6d1dd7

Here's the login:

$password = strtolower($_POST['pass_word']);
$passwordMD5 = md5($password);
 $sql="select num_logins, person_id, primary_title, home_unit from user where user_name = '".$user_name."' AND password='".$passwordMD5."'";
 $result=mysql_query($sql);

results in this hash: 7d61a1b105670539554b7a17536e672c

[Piranha]

In the login you make the string to lower letters with [man]strtolower[/man]. Remove that part and it is likely that it will work.

[Chris_96_WS6]

Ah...perfect. That's what I get from borrowing code.

[Piranha]

Well, if you borrow code without looking through it you risk much more than that. You risk that the code is really malicious, sending mail with passwords or removing files for instance.

[Chris_96_WS6]

Its not code from just somewhere off the net. This is for a work application, and I am modifying/updating/improving a previous version designed by another employee in another area of the company.

The code is safe...it is just not optimized.