md5 password + salt

[MarkPW]

It sounds as though you aren't escaping certain value(s) in your sql statement. Are you using mysql_escape_string() on your variables before you use them in your statement?

[Norco]

No? The source to the script I am using is located in the first post in this thread, I quoted it below.

Originally Posted by Norco

Alright, I have a website with a user system, all the user passwords are stored in a mysql database and md5 encrypted. I am attempting to re-encrypt all those passwords with a salt so the same password will be used on my website, as the forum. I have come up with this..

http://www.teenagezone.org

I'm using functions straight from vBulletin to do it, and when I get it working right, changing it so it will loop through all the users in my database and update their password to work with a salt. Now.. it dosn't seem to be working right. The script works, but when I update that in the database for vbulletin, and try logging in, it will not work.

Here is the scripts..

index.php

PHP Code:

<?php
include "pwfunction.php";

if (!$_POST['submit']){
echo "<form method='POST' style='margin: 0px;'>
<b>Hash: </b>
<input type='password' name='pass'><br><br>
<input type='submit' name='submit' value='sumbmit'>
</form>";
}else{
$password = $_POST['pass'];

$salt = fetch_user_salt();
$hash = hash_password($password, $salt);

echo ("$hash - $salt");

}
?>

pwfunction.php

PHP Code:

<?php

    function hash_password($password, $salt)
    {
        if ($password == '')
        {
        }
        else if (verify_md5($password))
        {
            $password = md5($password);
        }
        return md5($password . $salt);
    }


function fetch_user_salt($length = 3)
{
    $salt = '';
    for ($i = 0; $i < $length; $i++)
    {
        $salt .= chr(rand(33, 126));
    }
    return $salt;
}

    function verify_md5(&$md5)
    {
        return (preg_match('#^[a-f0-9]{32}$#', $md5) ? true : false);
    }
    
?>

Does anyone know the problem or can give me some advice of why it is not working.

[MarkPW]

AFAIK your problem is to do with your SQL statement. Your script above tells me nothing that will explain your SQL errors.

[Norco]

You asked if I was using mysql_escape_string()... which would be in the source if I was, right?

[MarkPW]

Where are your SQL errors generated from? You're giving me half the story - I haven't a clue what's happening in the "rest" of your script. The above script generated a password hash with salt. It has does nothing to do with your database. Your SQL errors are coming from somewhere...

[Norco]

Originally Posted by MarkPW

Where are your SQL errors generated from? You're giving me half the story - I haven't a clue what's happening in the "rest" of your script. The above script generated a password hash with salt. It has does nothing to do with your database. Your SQL errors are coming from somewhere...

OH. Ok here:

PHP Code:

<?php
include "pwfunction.php";

 $dbh=mysql_connect ("localhost", "user", "password") or die ('I cannot connect to the database because: ' . mysql_error());
mysql_select_db ("database");

$get = mysql_query("SELECT * FROM users") or die('Error, query failed');
while($row = mysql_fetch_array($get)){

$password = $row['password']; 
$id = $row['id'];

$salt = fetch_user_salt();
$hash = hash_password($password, $salt);

$update = mysql_query("UPDATE users SET `password`='$hash', `salt`='$salt' WHERE `id`='$id'") or die(mysql_error());
}
?>

pwfunctions.php is the same. Sorry my bad, I forgot to add the updated script for running it.

[MarkPW]

Since you have a connection to your database, you can use mysql_real_escape_string() (which you should use anyway). This should solve your problem:

PHP Code:

$salt = mysql_real_escape_string(fetch_user_salt());
$hash = mysql_real_escape_string(hash_password($password, $salt));

$update = mysql_query("UPDATE users SET `password`='$hash', `salt`='$salt' WHERE `id`='$id'") or die(mysql_error()); 


[Norco]

Let me try this, just a second.

Ah! It worked! Thank you SO MUCH.