vb.org Archive - md5 password authentication on non-vb pages.

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- vB3 General Discussions (https://vborg.vbsupport.ru/forumdisplay.php?f=111)

- - md5 password authentication on non-vb pages. (https://vborg.vbsupport.ru/showthread.php?t=64491)

md5 password authentication on non-vb pages.

I've got a contest in development on my site where members will vote on a winning. However, I require that they be members before that can upload entries and submit a vote (when the contest is in the voting stage).

I had this working before VB3.. with VB2.. however now it no longer works. Below is the code I used for VB2 and VB3 to compare the submitted password with the one stored in the database.

I realize the password is encrypted in the database and can not be reversed. However I guess I need to encrypt the password the member inputs and then compare that to the one stored in the database. IF they match.. access granted.. if they don't.. end.

Here's the VB2 Code:

Code:

$query = "select password, userid from user where username='$username'";

$result = mysql_query($query) or die("Query failed");



$row=mysql_fetch_array($result);



$userid = $row['userid'];

        

if ($row['password'] == md5($password)) {

        print "Password correct<br><br>";

}

else {

        die("password not correct!");

}

Here's the VB3 Code that never correctly matches the passwords:

Code:

$query = "SELECT password FROM user WHERE username='$username' AND password = MD5(CONCAT(MD5('$password'), salt))"; 

$result = mysql_query($query) or die("Query failed");



$row=mysql_fetch_array($result);



$userid = $row['userid'];



/* THIS IS WHERE THE PROBLEM IS */



if ($row['password'] == MD5(CONCAT(MD5('$password'), salt)) {

        print "Password correct!<br><br>";

}

else {

        die("password not correct!");

}

Any help on how to properly encrypt the inputed password to match that stored in the database would be greatly appreciated.

Aceman

Why not just use the vB login html from the navbar template?

Anyone know how to properly encrypt a submitted password so it can be checked against the one in the VB database?

Aceman

Code:

echo $row['password'];

print "<br>";

echo (md5($password). salt) ;

does not return the same numbers at all. But it DOES pull the correct one from the VB database.

A friend of mine who's a PHP GOD.. helped me figure this one out. Daneel.. you da man!

You can use the following code to accept a username and password from a form and then compare it to what's stored in the VB3 Database. NOTE This takes into account the md5 and salt encryption. It works perfectly for me.

Code:

// hostname or ip of server

        $servername='localhost';



        // username and password to log onto db server

        $dbusername='?????????';

        $dbpassword='?????????';



        // name of database ($dbname2 is my VB3 database)

        $dbname='MY_contest';

        $dbname2='MY_forum';



        /* Connecting, selecting database */

        $link = mysql_connect($servername, $dbusername, $dbpassword)

                or die("Could not connect");

        print "Connected successfully<br><br>";

        mysql_select_db($dbname2) or die("Could not select database");



        /* Necessary fields filled? */

        if (!$username || !$password || !$name || !$country || !$email || !$picture || !$stats)

                die("Fill in all necessary fields.");





        /* password correct? */

        $query = "SELECT salt, password FROM user WHERE username='$username'"; 

        $result = mysql_query($query) or die("The information you entered does not match our records.");

        $row=mysql_fetch_array($result);



        $dbpassword = $row['password'];

        $salt = $row['salt'];        



        if ($dbpassword == md5(md5($password). $salt)) {

                print "Password correct<br><br>";

        }

        else {

                die("password not correct!");

        }

Then just place the rest of whatever you need your page to do after the password comparison.

I honestly have yet to find this code posted anywhere on VB.org and VB.com so I hope this helps someone!

Aceman

X vBulletin 3.8.12 by vBS Debug Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (4)bbcode_code_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (5)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages:

Phrase Groups Available:

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01640 seconds Memory Usage 1,727KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (4)bbcode_code_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (5)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: