No that's not right, I've just done some looking into this because I wanted to make a quick vblogin script...OK,
When you make a login script, you query the password from the row that belongs to that user right? OK, on the same row, you will find a cell called 'salt', which holds a random peice of junk. You need to use that salt cell along with the MD5 encryption of the entered password to make the same as what's in the database.
You almost have it right on that thread, but you are just putting 'salt' as a normal piece of text when it is actually a variable that you need to gather from the user records.
Don't just copy the whole lot, this is just an extract of the script I used, but you can see what I am doing
PHP Code:
$result = mysql_query("SELECT password, salt FROM `".$db_prefix."user` WHERE `username` = '".$_POST['username']."'");
$salt = mysql_result($result, 0, salt);
$passwd = $_POST['password'];
// Then when encrypting, you'd use this to check against the user.password cell:
$enc_passwd = md5(md5($passwd).$salt);
Got it?
08-28-2006, 01:53 PM
Hybrid Mode
