passwords in php/mysql

babelfish · 02-02-2009, 02:28 PM

hi peeps.

i have designed a new system for a client, based on a system we have currently here.

the problem is that in our system (which i administrate) i can see our passwords (due to people having the memory of a sieve) so i took out the code that encrypted/hashed/whatever-its-called passwords, so they cant be viewed.

so, how can i incorporate hiding the passwords again?

i tried password() when putting back into mysql, but then i couldnt log in with the password any more?!?!

help!!!!!!!! thanks!

rangana · 02-02-2009, 02:41 PM

You can choose from md5() or sha1().

babelfish · 02-02-2009, 02:59 PM

thanks mate.

Voltar · 02-03-2009, 06:06 AM

If you have the ability to, I would use salted, hashed passwords. You could use a random individual salt for each user (new database table possibly), and concatenate the salt and password being submitted together and see if it matches the md5/sha1 sum in the database.

babelfish · 02-03-2009, 08:16 AM

the basic one above will work fine - this isnt on the web, its just a little system to sit on a box at one of my clients. if it were web enabled i might look into more security