Recipe 18.7. Storing Passwords


18.7.1. Problem

You need to keep track of users' passwords, so they can log in to your web site.

18.7.2. Solution

When a user signs up or registers, encrypt the chosen password with md5( ) and store the encrypted password in your database of users. For best results, use a salt:

<?php /* Initialize an array for filtered data. */ $clean = array(); /* Define a salt. */ define('SALT', 'flyingturtle'); /* Encrypt the password. */ $encrypted_password = md5(SALT . $_POST['password']); /* Allow alphanumeric usernames. */ if (ctype_alnum($_POST['username'])) {     $clean['username'] = $_POST['username']; } else {     /* Error */ } /* Store user in the database. */ $st = $db->prepare('INSERT             INTO   users (username, password)             VALUES (?, ?)'); $st->execute(array($clean['username'], $encrypted_password)); ?> 

Then, when that user attempts to log in to your web site, encrypt the supplied password with md5( ) and compare it to the stored encrypted password. If the two encrypted values match, the user has supplied the correct password:

<?php /* Initialize an array for filtered data. */ $clean = array(); /* Define a salt. */ define('SALT', 'flyingturtle'); /* Allow alphanumeric usernames. */ if (ctype_alnum($_POST['username'])) {     $clean['username'] = $_POST['username']; } else {     /* Error */ } $encrypted_password = $db->getOne('SELECT password                                    FROM   users                                    WHERE  username = ?',                                    array($clean['username'])); if (md5(SALT . $_POST['password']) == $encrypted_password) {     /* Login succeeds. */ } else {     /* Login fails. */ } ?> 

18.7.3. Discussion

Storing encrypted passwords prevents users' accounts from becoming compromised if an unauthorized person gets a peek at your username and password database (although such unauthorized peeks may foreshadow other security problems).

Using a salt as demonstrated helps protect against the presence of rainbow tables. Rainbow tables are collections of strings along with the encrypted version of those strings. For example, http://md5.rednoize.com/ is a rainbow table lookup facility for MD5. If you enter a query such as 6b34fe24ac2ff8103f6fce1f0da2ef57 (the MD5 of chris), you can see how easily plain MD5s can be broken. By using a salt, the effectiveness of such a tool is significantly reduced.

Because MD5 is a one-way algorithm, your stored passwords are somewhat more secure. This also means that you can't get at the plain text of users' passwords, even if you need to. For example, if a user forgets his password, you won't be able to tell him what it is. The best you can do is reset the password to a new value and then tell the user the new password. A method for dealing with lost passwords is covered in Recipe 18.8.

18.7.4. See Also

Recipe 18.11 for information on storing encrypted data; documentation on md5( ) at http://php.net/md5.




PHP Cookbook, 2nd Edition
PHP Cookbook: Solutions and Examples for PHP Programmers
ISBN: 0596101015
EAN: 2147483647
Year: 2006
Pages: 445

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net