Creating a Login Script

[10sion]

Alright im trying to create a login script for the forum, dont ask me why but I need to create another one that logs the user in the forums, one thing got me stuck though, vbulletin encrypts the passwords and I cant figure out there encryption method.

All I need to do is compare the posted password (then encrypt it and i dont know how) to the password in the database, anyone care to show me how to encrypt it, NOTE: I cannot include any of the vbulletin files in my code.

Heres what you have to work off of:

<?php
$username = $_POST['username'];
$password = $_POST['password'];
?>

I know the password is not just md5'ed i saw something like utf, never heard of it, and theres a salt stored in the database for each user, dont know what its for... please help its really important .

[Marco van Herwaarden]

Do a search on 'password salt' in the General Modification Discussion section and you will find many threads anwering this.

[Colin F]

md5( md5( password ) . $salt ); is how the password is saved in the database

[10sion]

Alright thanks, I wrote up this code:

		$query[select1] = mysql_query("SELECT userid, username, password, salt FROM user WHERE username='".$_POST[username]."' LIMIT 1");
		$fetch[select1] = mysql_fetch_array($query[select1]);
		print md5(md5($_POST[password]).$fetch[select1][salt]);

And what it printed out wasnt the same password that was stored in the database...

[AN-net]

why cant u include any vbulletin files?

[10sion]

Because im running this on a diffrent domain than the forums are on (but on the same server).

Im already connected to the database I just need to somehow get the posted password to encrypt correctly to match the one in the database >_>

[10sion]

I read somewhere that md5 encrypts diffrently for diffrent domains, is this true? I thought it was just diffrently for each server... the domain thing isnt gonna be a problem for md5 is it?

Man im stupid, the query wasnt fetching because me being my forgetful self forgot to include config.php so I wasnt even connected to the database, and the script wasnt showing that there was an error, so didnt look like there was anything wrong, I fixed that, now it matches up to the one in the database, thanks again.