md5 password + salt

[Norco]

Alright, I have a website with a user system, all the user passwords are stored in a mysql database and md5 encrypted. I am attempting to re-encrypt all those passwords with a salt so the same password will be used on my website, as the forum. I have come up with this..

http://www.teenagezone.org

I'm using functions straight from vBulletin to do it, and when I get it working right, changing it so it will loop through all the users in my database and update their password to work with a salt. Now.. it dosn't seem to be working right. The script works, but when I update that in the database for vbulletin, and try logging in, it will not work.

Here is the scripts..

index.php

PHP Code:

<?php
include "pwfunction.php";

if (!$_POST['submit']){
echo "<form method='POST' style='margin: 0px;'>
<b>Hash: </b>
<input type='password' name='pass'><br><br>
<input type='submit' name='submit' value='sumbmit'>
</form>";
}else{
$password = $_POST['pass'];

$salt = fetch_user_salt();
$hash = hash_password($password, $salt);

echo ("$hash - $salt");

}
?>

pwfunction.php

PHP Code:

<?php

    function hash_password($password, $salt)
    {
        if ($password == '')
        {
        }
        else if (verify_md5($password))
        {
            $password = md5($password);
        }
        return md5($password . $salt);
    }


function fetch_user_salt($length = 3)
{
    $salt = '';
    for ($i = 0; $i < $length; $i++)
    {
        $salt .= chr(rand(33, 126));
    }
    return $salt;
}

    function verify_md5(&$md5)
    {
        return (preg_match('#^[a-f0-9]{32}$#', $md5) ? true : false);
    }
    
?>

Does anyone know the problem or can give me some advice of why it is not working.

[Dismounted]

pwfunction.php, function 'hash_password'.

PHP Code:

else if (verify_md5($password)) 


Should be:

PHP Code:

else if (!verify_md5($password)) 


[Norco]

Wow, thanks! I would have never thought to do that and would be sitting there for days attempting to make it work.

Sorry for double posting, but I have something to add to this post. I currently have the script grabbing users from my website testing database, and it works! But.. it only does some, then errors. The reason being is to much work for the server doing this in a while loop for 4000 members (re encrypting plus producing a slat). Does anyone know how to limit how many it will do in a second/minute, or offer a idea for a different solution for doing this which will work?

Thanks.

[Norco]

Originally Posted by Norco

Wow, thanks! I would have never thought to do that and would be sitting there for days attempting to make it work.

Sorry for double posting, but I have something to add to this post. I currently have the script grabbing users from my website testing database, and it works! But.. it only does some, then errors. The reason being is to much work for the server doing this in a while loop for 4000 members (re encrypting plus producing a slat). Does anyone know how to limit how many it will do in a second/minute, or offer a idea for a different solution for doing this which will work?

Thanks.

Anyone?

[Dismounted]

Add a variable. Increase it every time a user goes by.

[Norco]

Originally Posted by Dismounted

Add a variable. Increase it every time a user goes by.

How so?

[MarkPW]

What kind of errors do you get?

[Norco]

Originally Posted by MarkPW

What kind of errors do you get?

It just says you have a error with your sql syntax, but I think its because a) it is loading all random characters, right? So it is interfering with the sql update query and/or b) it is trying to load all 4000 at the same time, causing it to stop.

It only does about 10-20 then errors.... the highest its ever gotten was to 75, but then I have to drop the table and upload the backup to try again. The only thing I can think of doing is adding check boxes to the script with the usernames, check off 10, click submit, and it will update those one, then in the while loop it will only grab rows where there is noting in the salt field. But that would take a long time...

[MarkPW]

What exactly is the error with your SQL syntax?

[Norco]

Originally Posted by MarkPW

What exactly is the error with your SQL syntax?

It varies with each run. For example:

First run:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '$R' WHERE `id`='1819'' at line 1

Second run:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1472'' at line 1

Third run:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'E' WHERE `id`='3290'' at line 1

By run I mean refresh.