md5 of nothing returned from database & moving forward

sareejoh

I stored passwords in a mysql database using md5, and I have one script working that confirms an email address/password match to log someone in. Now I'm working on another script to allow the person to update their password, but I can't get the password retrieved to match.

	$check_pass = md5($old_pass);

$valid_user = $_SESSION['valid user'];

$query = "	SELECT password 
			FROM users 
			WHERE email = '$valid_user'
			LIMIT 1";

$result = mysql_query($query) or die ("Error in query: $query. " . mysql_error());

while ($row = mysql_fetch_object($result)) 
		{
			$stored_pass = $row->password;
		}

if($check_pass<>$stored_pass)
{
	print 'stored: '.$stored_pass.'<br/>';
	print 'entered: '.$check_pass;
	$error .= "<li>The old password entered does not match the database.</li>";
}

This is what is returned. The one that it says is stored in the db is not what is actually stored there. And apparently it's the md5 of nothing? When I enter the query in the mysql db directly, it works fine and returns the proper value. Any ideas?

stored: d41d8cd98f00b204e9800998ecf8427e
entered: dc050ee2df0b09b13b3f9be754e27aad

Also, I've been doing a lot of reading of other posts on the site re: md5 and wondering if I should worry about adding a salt or other additional security. The only validation I did on the passwords is that users chose is that they had to be at least 6 characters. If I want to change it now, I'll have to make everyone create a new password, which I can't imagine they would like too much... I'm really a novice at this, but I'm trying to make a pretty complex site completely on my own and I've got so many questions!

laserlight

"password" might be a reserved word for MySQL, so perhaps you should quote it. I suggest:

$check_pass = md5($old_pass);

$query = sprintf("SELECT `password`
    FROM users
    WHERE email = '%s'
    LIMIT 1",
    mysql_real_escape_string($_SESSION['valid user']));

$result = mysql_query($query) or die ("Error in query: $query. " . mysql_error());

$stored_pass = mysql_result($result, 0);

if ($check_pass <> $stored_pass)
{
    echo 'stored: ' . $stored_pass . '<br/>';
    echo 'entered: ' . $check_pass;
    $error .= "<li>The old password entered does not match the database.</li>";
}

Incidentally, I suggest that you use the PDO extension instead, or the MySQLi extension if you prefer. You would then be able to use prepared statements with the given PHP interface.

sareejoh wrote:
Also, I've been doing a lot of reading of other posts on the site re: md5 and wondering if I should worry about adding a salt or other additional security.

Yes, you should add a user specific salt at the very least.

coldwerturkey

sareejoh;10909750 wrote:
Also, I've been doing a lot of reading of other posts on the site re: md5 and wondering if I should worry about adding a salt or other additional security.

sha1()+slat > md5()+salt

cahva

If that gives that value straight from database, it means that you have really inserted some user with MD5'ed empty password. Because that stored value is the same as md5('').

I also first thought that "password" could be reserved word in mysql but it isnt(atleast in mysql 5).

sareejoh

cahva;10909760 wrote:
If that gives that value straight from database, it means that you have really inserted some user with MD5'ed empty password. Because that stored value is the same as md5('').

The thing is, that's not what is really stored. If I look at the database directly, the second line is what is stored...

Weedpacket

Let me get this straight:

The password field in the database contains the string "dc050ee2df0b09b13b3f9be754e27aad" (the MD5 of a certain 5-letter word that I'll keep mum on for the moment, but I think something might be wrong with your validation routine).

But when you retrieve it, the string you get is "d41d8cd98f00b204e9800998ecf8427e" (the MD5 of an empty string).

Right?

You're sure the email is unique? That there isn't another record with the same email that has an empty password field?

sareejoh

Weedpacket;10909805 wrote:
Let me get this straight:

The password field in the database contains the string "dc050ee2df0b09b13b3f9be754e27aad" (the MD5 of a certain 5-letter word that I'll keep mum on for the moment, but I think something might be wrong with your validation routine).

But when you retrieve it, the string you get is "d41d8cd98f00b204e9800998ecf8427e" (the MD5 of an empty string).

Right?

Yes. But it's not a 5 letter word. 😉

Weedpacket;10909805 wrote:
You're sure the email is unique? That there isn't another record with the same email that has an empty password field?

Yes I checked that, I'm just running this on my local server for now. I even tried deleting all the entries from the database except that one.

I also did a print $query and pasted it into the SQL box on the phpmyadmin page, and got the proper result there...