PHP authentication with mysql encrypt function

[falko]

Try

INSERT INTO users(..., password) VALUES('...', ENCRYPT(".$_POST['password']."));

[Mark_NL]

Falko, with that query, MySQL will use a different salt every time you call it, so the same entered password, it will be saved differently in the db, and you can never match against it, since you don't know the salt mysql used during

INSERT INTO users(name, pass) VALUES('john', ENCRYPT('password','(*#Ng383'));

This will save the same encrypted string over and over.

for his solution he should use:

INSERT INTO users(..., password) VALUES('...', ENCRYPT(".$_POST['password'].", 'odufmsircklsc'));

("odufmsircklsc" being the salt)

[new]

@Falko and @Mark_NL .... thanks guys...

@Mark_NL .........
for his solution he should use:

INSERT INTO users(..., password) VALUES('...', ENCRYPT(".$_POST['password'].", 'odufmsircklsc'));

("odufmsircklsc" being the salt)

You are the man.. works perfect .. I do have not words to thanks you...that was exactly what I was looking for.... now I can authenticate users from the same database for mail and ftp, with the same ENCRYPT password..

Just curious .. ... what character users are allow to use in password field of my registration from... because ... ("odufmsircklsc" being the salt) ... or don't matter ???

Regards.. you all ..!!
Really thanks...

[beaney]

Im having trouble getting my login to work on my site.
it keeps telling me query failed, but when i echo out the username and password it matches the one on the server so i dont understand why its not working.
Im a new programmer by the way very noob.

PHP Code:

$db = mysqli_connect($server, $user, $password, $database);
        
       
            $salt = "45Gxkj9583lPMdxoekfg"; 
        $user = $_POST['username'];
        $pass = crypt($_POST['password'], $salt);
            
        echo "<h2>welcome you are now logged in ".$user." ".$pass."</h2><br />\n";
        $sql = "SELECT username, password FROM faculty WHERE username = $user AND password = $pass";
        
        $result = mysqli_query($sql,$db) or die('Query failed: ' . mysql_error($db));
        
        if (mysql_num_rows($result) == 1)
        {
            //successful login
            echo "<h2>Welcome  You are now logged in.</h2>\n";
        }
        else
        {
            // not successful
            $page = file_get_contents("err_login.html");
                    echo $page;
                    exit;
        }
        
            
            
            //session_start();
            //$_SESSION['valid'] = 1;
            //$_SESSION['user'] = $username; 


[beaney]

this is a link to my project http://trieste.sdsu.edu/~trst016/proj2/proj2.html

[Mark_NL]

try:

PHP Code:

$sql = "SELECT username, password FROM faculty WHERE username = '$user' AND password = '$pass'"; 


notice the single quotes i put around $user and $pass

[beaney]

no that doesnt work.