vb.org Archive - External Site login from application (salt, MD5 issue)

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- vB3 Programming Discussions (https://vborg.vbsupport.ru/forumdisplay.php?f=15)

- - External Site login from application (salt, MD5 issue) (https://vborg.vbsupport.ru/showthread.php?t=270144)

External Site login from application (salt, MD5 issue)

Hi all,

I've been pulling my hair out trying to figure out what's wrong. I think my method is wrong.

The code works fine with plain text passwords but I can't seem to figure out how to use salt!

PHP Code:


		
			
<?php

$username = $_POST['username'];
$password = $_POST['password'];

if (selectFromDB() == md5(md5($password).$count['salt'])) {
   echo "Accept";
} else {
   echo "Denied";
}

function selectFromDB() {
    
    global $username;
    //Database service vars
    $databasehost = "localhost";
    $databasename = "nes";
    $databasetable = "test";
    $databaseusername ="root";
    $databasepassword = "password";

    $con = mysql_connect($databasehost,$databaseusername,$databasepassword) or die(mysql_error());
        mysql_select_db($databasename) or die(mysql_error());

    
    $query = "SELECT password,salt FROM user WHERE username='$username'";
    
    $result = mysql_query($query);
    $count = mysql_num_rows($result);

    if ($count)
    {
        $output = mysql_result($result, 0);        
        return $output;
    }
    else
    {
        return "0";
    }
    mysql_free_result($result);
    mysql_close($con);
}

?>

Thanks for your time

I don't see how you're getting the salt value, but maybe that's what you mean when you say you can't figure out how to use it.

I think I'd make a "check password" function where you pass it the username and password and it returns true or false. Maybe like:

PHP Code:


		
			
function checkPassword($username, $password) 

{

    //Database service vars

    $databasehost = "localhost";

    $databasename = "nes";

    $databasetable = "test";

    $databaseusername ="root";

    $databasepassword = "password";



    $con = mysql_connect($databasehost,$databaseusername,$databasepassword) or die(mysql_error());

     mysql_select_db($databasename) or die(mysql_error());

    

    $query = "SELECT password,salt FROM user WHERE username='" . mysql_real_escape_string

($username) . "'";

    

    $result = mysql_query($query);

    $row = mysql_fetch_array($result);

    mysql_free_result($result);

    mysql_close($con);



    if ($row)

        return md5(md5($password) . $row['salt']) === $row['password'];



    return false;

}

(BTW, I haven't tried this at all).

Thanks for your help. I still can't seem to get it working! Not sure where I'm going wrong, I need it to echo Accept or Denied if the password is correct but I keep going wrong somewhere.

It works for me, after fixing a couple of typos in the code I posted (I've fixed them above as well). I used code like this to test it:

PHP Code:


		
			
$username = $_POST['username'];

$password = $_POST['password'];



if (checkPassword($username, $password))

   echo "Accept";

else 

   echo "Denied";

One thing: I don't know where your password is coming from, but I think the vb code runs the password through md5 in javascript before sending it, but also has to allow for browsers with javascript disabled. So when it checks the password, it checks both ways. I guess you could do the same thing by using this code:

PHP Code:


		
			
if (checkPassword($username, $password) OR checkPassword($username, md5($password)))

   echo "Accept";

else 

   echo "Denied";

X vBulletin 3.8.12 by vBS Debug Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (4)bbcode_php_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (4)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages:

Phrase Groups Available:

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01222 seconds Memory Usage 1,741KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (4)bbcode_php_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (4)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: