External Site login from application (salt, MD5 issue)

[fleccy]

Hi all,

I've been pulling my hair out trying to figure out what's wrong. I think my method is wrong.

The code works fine with plain text passwords but I can't seem to figure out how to use salt!

PHP Code:

<?php

$username = $_POST['username'];
$password = $_POST['password'];

if (selectFromDB() == md5(md5($password).$count['salt'])) {
   echo "Accept";
} else {
   echo "Denied";
}

function selectFromDB() {
    
    global $username;
    //Database service vars
    $databasehost = "localhost";
    $databasename = "nes";
    $databasetable = "test";
    $databaseusername ="root";
    $databasepassword = "password";

    $con = mysql_connect($databasehost,$databaseusername,$databasepassword) or die(mysql_error());
        mysql_select_db($databasename) or die(mysql_error());

    
    $query = "SELECT password,salt FROM user WHERE username='$username'";
    
    $result = mysql_query($query);
    $count = mysql_num_rows($result);

    if ($count)
    {
        $output = mysql_result($result, 0);        
        return $output;
    }
    else
    {
        return "0";
    }
    mysql_free_result($result);
    mysql_close($con);
}

?>

Thanks for your time

[kh99]

I don't see how you're getting the salt value, but maybe that's what you mean when you say you can't figure out how to use it.

I think I'd make a "check password" function where you pass it the username and password and it returns true or false. Maybe like:

PHP Code:

function checkPassword($username, $password) 
{
    //Database service vars
    $databasehost = "localhost";
    $databasename = "nes";
    $databasetable = "test";
    $databaseusername ="root";
    $databasepassword = "password";

    $con = mysql_connect($databasehost,$databaseusername,$databasepassword) or die(mysql_error());
     mysql_select_db($databasename) or die(mysql_error());
    
    $query = "SELECT password,salt FROM user WHERE username='" . mysql_real_escape_string
($username) . "'";
    
    $result = mysql_query($query);
    $row = mysql_fetch_array($result);
    mysql_free_result($result);
    mysql_close($con);

    if ($row)
        return md5(md5($password) . $row['salt']) === $row['password'];

    return false;
} 


(BTW, I haven't tried this at all).

[fleccy]

Thanks for your help. I still can't seem to get it working! Not sure where I'm going wrong, I need it to echo Accept or Denied if the password is correct but I keep going wrong somewhere.

[kh99]

It works for me, after fixing a couple of typos in the code I posted (I've fixed them above as well). I used code like this to test it:

PHP Code:

$username = $_POST['username'];
$password = $_POST['password'];

if (checkPassword($username, $password))
   echo "Accept";
else 
   echo "Denied"; 


One thing: I don't know where your password is coming from, but I think the vb code runs the password through md5 in javascript before sending it, but also has to allow for browsers with javascript disabled. So when it checks the password, it checks both ways. I guess you could do the same thing by using this code:

PHP Code:

if (checkPassword($username, $password) OR checkPassword($username, md5($password)))
   echo "Accept";
else 
   echo "Denied";