vb.org Archive - bbpassword Query

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- vB3 Programming Discussions (https://vborg.vbsupport.ru/forumdisplay.php?f=15)

- - bbpassword Query (https://vborg.vbsupport.ru/showthread.php?t=206336)

digitalstudio

02-23-2009 01:02 PM

bbpassword Query

Hi.

I need to write a query that takes the value of the "bbpassword" cookie and checks it against the user table "password" field.

The query will look something like this:

PHP Code:


		
			
$stmt = "SELECT user.`userid` 
         FROM `user` 
         WHERE `password` = '" . md5($_COOKIE['bbpassword'])  . "' ";

My question is: Which functions do I need to run of the bbpassword cookie value to check it against the password field? As I'm pretty sure md5() isn't the only one!

Thanks.

TigerC10

02-23-2009 01:41 PM

The cookie password is:

PHP Code:


		
			
md5(md5(md5($password) . $salt) . $license)

The password hash in the user table is:

PHP Code:


		
			
md5(md5($password) . $salt)

It is not possible to "undo" a hash. You cannot search for passwords in the database like this. In order to do what you want, you'll have to select password from the database - and then run a while loop that hashes the values out and then compares with the cookie data.

PHP Code:


		
			
$passes = $db->query_read("SELECT password FROM ". TABLE_PREFIX ."user");

while( $user = $db->fetch_array($passes) )

{

     if( md5( $user[password] . $license ) == $_COOKIE['bbpassword'] )

     {

          //Do something that you want to do when the password matches

          break;

     }

}

This is terribly inefficient, I wouldn't do it if I were you.

digitalstudio

02-23-2009 02:11 PM

Quote:

Originally Posted by TigerC10 (Post 1752299)

PHP Code:


		
			
$passes = $db->query_read("SELECT password FROM ". TABLE_PREFIX ."user");
while( $user = $db->fetch_array($passes) )
{
     if( md5( $user[password] . $license ) == $_COOKIE['bbpassword'] )
     {
          //Do something that you want to do when the password matches
          break;
     }
}

This is terribly inefficient, I wouldn't do it if I were you.

You're right. But you can do the same thing in a single query. I forgot to mention that i will also be doing a lookup on the user ID:

PHP Code:


		
			
$stmt = "SELECT user.`userid` 
         FROM `user` 
         WHERE MD5(CONCAT(user.`password`, '" . $license . "')) = '" . $_COOKIE['bbpassword'] . "' 
         AND user.`userid` = '" . $userid . "'";

But thanks for the info, you've answered my question.

TigerC10

02-23-2009 03:41 PM

I wasn't aware MySQL had an MD5 function, is that a new addition for MySQL 5? That makes things totally different.

Dismounted

02-24-2009 04:41 AM

It's existed prior to that: http://dev.mysql.com/doc/refman/4.1/...functions.html

All times are GMT. The time now is 01:13 AM.

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01010 seconds Memory Usage 1,737KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (6)bbcode_php_printable (1)bbcode_quote_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (5)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: