PHP - Comparing hash with database is not working

Question

Notes:

I'm still fairly new to php
This login form seems to work perfectly fine if I don't hash the password.
I've tried md5, sha256 and now I've left it at sha1. None of these work.
I first used echo sha1("password"); to find out what the hash for my password would be, I then copied that hash and pasted it manually with phpMyAdmin. I'm not sure if this is what the issue is or not.

Anyways here is the code:

<?php
session_start();
require("config.php");

if(isset($_POST['submit'])) {

    $username = mysql_real_escape_string($_POST['username']);
    $password = sha1(mysql_real_escape_string($_POST['password']));

    $loginsql = "SELECT * FROM login WHERE username = '" . $username .
    "' AND password = '" . $password . "'";
    $loginresult = mysql_query($loginsql);
    $loginnumrows = mysql_num_rows($loginresult);

    if($loginnumrows == 1) {
        $loginrow = mysql_fetch_assoc($loginresult);
        session_register("USERNAME");
        session_register("USERID");

        $_SESSION['USERNAME'] = $loginrow['username'];
        $_SESSION['USERID'] = $loginrow['id'];

        header("Location: " . $config_basedir . "controlpanel.php");
    }
    else{
        echo "<p>Incorrect Login, please try again!</p>";
    }
}
else{

}
?>

I'm really not too sure where to go with this. I'm sure my code could be more efficient but as I mentioned in the notes, it does work when I don't hash the password. Thank you for reading.

You shouldn't be using mysql_real_escape_string until right before the data is sent to the database. Specifically, sha1(mysql_real_escape_string($_POST['password'])); should be mysql_real_escape_string(sha1($_POST['password']));. We also can't see how the stored password is hashed, so we can't really help you. Try selecting the record and var_dumping your password. Compare this with the value being posted to the server. These are basic debugging steps you should learn to follow. — user229044
– user229044 ♦, Commented Feb 14, 2012 at 22:03
Did you try $password = sha1($_POST['password']); ? No need for mysql_real_escape_string here. — aletzo
– aletzo, Commented Feb 14, 2012 at 22:03
When you created the hash in the first place (to insert into the DB) did you also run the text through mysql_real_escape_string? If not, and your password contains special characters it could get mangled by mysql_real_escape_string. You need to do it the same way both times. — Jim Garrison
– Jim Garrison, Commented Feb 14, 2012 at 22:04
Compare the hash in the exact same way it's being inserted into the database in the first place. — Scuzzy
– Scuzzy, Commented Feb 14, 2012 at 22:04

iblue · Accepted Answer · 2012-02-14 22:05:49Z

4

This will not work, if your password contains any ' or other escapeable characters.

$password = sha1(mysql_real_escape_string($_POST['password']));

You should hash first, then escape:

$password = mysql_real_escape_string(sha1($_POST['password']));

And as a SHA1 only contains [a-f0-9], you can as well skip the escpaing

$password = sha1($_POST['password']);

answered Feb 14, 2012 at 22:05

iblue

30.6k20 gold badges93 silver badges130 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

krizzo Over a year ago

I agree this is the best answer. I noticed he was hashing after escaping.

finec Over a year ago

I forgot to mention it, but I've already tried this and it isn't fixing my problem. Thanks though.

Francis Lewis · Accepted Answer · 2012-02-14 22:03:29Z

1

If it works when you don't hash the password, it sounds like your passwords are stored in the database as plaintext - that would be where I would check.

The other thing that might be happening is mysql_real_escape string should be used on the other side of the sha1 so it doesn't interfere with the exact input.

So it should be: mysql_real_escape_string(sha1($_POST['password'])); That might change things a bit.

Note: Although sha1 doesn't currently have any known security issues so it should be safe to put directly into the database without the mysql escape, somebody once told me to always make sure everything that goes into the database should be cast or escaped just in case a security vulnerability is found in something like sha1 or md5.

answered Feb 14, 2012 at 22:03

Francis Lewis

8,9889 gold badges58 silver badges68 bronze badges

3 Comments

finec Over a year ago

That is what I thought might be the problem, however I'm not sure how to change that.

John V. Over a year ago

i believe they mean it works when they don't hash the password in both places. (meaning plaintext in db and plaintext lookup)

Francis Lewis Over a year ago

Sorry, I missed that you had copied a sha1 and put it in the database. I would try echo $password; after it's been through the sha1, then grab the result and insert that into the database and see if it works.

jeroen · Accepted Answer · 2012-02-14 22:09:20Z

1

It seems your passwords in the database are not hashed, you need to change that and your sign-up form so that all use the same hash method.

You can change all passwords in the database using MySQLs SHA1() function.

answered Feb 14, 2012 at 22:09

jeroen

91.8k22 gold badges117 silver badges132 bronze badges

Comments

krizzo · Accepted Answer · 2012-02-14 22:10:08Z

0

The escaped password is not the same hash as the entered password. The has will not contain any special characters.

abc' sha1 != escaped abc\' sha1

answered Feb 14, 2012 at 22:10

krizzo

1,9035 gold badges31 silver badges55 bronze badges

Collectives™ on Stack Overflow

PHP - Comparing hash with database is not working

4 Answers 4

2 Comments

3 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

2 Comments

3 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related