[RESOLVED] Encryption

[Dawg]

Code:

	function verify_password($given_user, $given)
		{

		if(strlen($given) > 0)
			{
				$sql = "SELECT * FROM `tbl_users` WHERE `user_name` = \"$given_user\"";
				//print("$given <br>");
				$result = mysql_query($sql, $this->conn) or die(mysql_error());
				print("$result <br>");
				if($result)
					{
						while ($row = mysql_fetch_array($result, MYSQL_NUM))				
							{
								$user_id = $row['0'];
								$user_name = ($row['1']);
								$stored = ($row['2']);
								$session = ($row['3']);														
							}
							print("$stored <br>");
							$crypt = (crypt($given, 11));
							print("$crypt <br>");
					}

				if ($stored == $crypt)
					{
						print("Passed <br>");
						$pwd_salt = 1;
					}
				else
					{
						print("Failed <br>");
						$pwd_salt = NULL;			
					}

			}
			print ("$pwd_salt <br>");
		return $pwd_salt;			
	}

Output from the print statmentes:

Resource id #5
11.Sss0exHVRQ
11.Sss0exHVRQ
Failed

First I have a stored password using the same crypt parameters as I am using to check the given password.

I don't think I fully understand who crypt works. because it seems to fail on the comparison test even thought the outout shows the stored and the given are the same.

Can someone see something I am missing?

Thanks
Dave

[dalecosp]

Dawg;10926444 wrote:

Code:

Can someone see something I am missing?

Thanks
Dave[/QUOTE]Actually, I'm not, OOTOMH, seeing it.  What do you get with:[code=php]

                if (strcmp($stored,$crypt)==0)
                    {
                        print("Passed <br>");
                        $pwd_salt = 1;
                    }
                else
                    {
                        print("Failed <br>");
                        $pwd_salt = NULL;            
                    }

?

[Dawg]

I tried the strcmp() and I added a trim() component just to make sure there was not white space.

I also changed the salt to a string instead of a number like is it supposed to be.

The output is as follows:

Resource id #6
sev9K73ciXnck
sev9K73ciXnck
Failed

I don't see how the compare fails when they are obviously the same.

Does anyone know of some basic reading on password encryption and verification for site security??

Thanks
Dave

[Dawg]

I found the issue, somehow the stored password had white space at the end.

I must have stored it before using the trim().