saving/retrieving passwords

[Toadums]

Hey...I was just wondering what the best way is to save passwords (in a db)?

currently i am just encrypting the passwords with md5, but this isnt ideal, because i cannot retrieve passwords...

ie. i would like to be able to have some php code which runs a query and returns a password.

if you have any suggestions of what i should use, let me know 🙂

thanks!

[NogDog]

If you want to be able to decrypt a password, then you need to encrypt it instead of hashing it (which is what md5() and other hash functions do). MySQL has built-in encryption/decryption functions such as AES_ENCRYPT()/AES_DECRYPT, or you could use the PHP [man]Mcrypt[/man] extension.

Many applications instead choose to hash the passwords, and then use some mechanism to either allow the user to change it (such as some security questions) or by generating a random, temporary password and emailing it to the user. This is done to make it more difficult for someone who might crack into your site to discover the passwords associated with the user names in the DB. Whether to do that or just encrypt/decrypt them depends on your specific security concerns versus desired user experience.

[dagon]

"Forgot Password" question

[Toadums]

NogDog;10927019 wrote:

Many applications instead choose to hash the passwords, and then use some mechanism to either allow the user to change it (such as some security questions) or by generating a random, temporary password and emailing it to the user.

that is perfect! i never even thought of that >.<

thanks guys!! 🙂