[SOLVED] md5 easy

[phpwiz]

ok well i am making a simple register with username, password, and confirm password. i am trying to do the md5 encryption but when they register it works fine but when they try to login it says wrong password and when i tried the encrypted password to login with it worked, can someone pease help!!!

 

register.php

<?php

$submit = $_POST['submit'];
// form data
$username = (strip_tags($_POST['username']));
$password = (strip_tags($_POST['password']));
$repeatpassword = (strip_tags($_POST['repeatpassword']));
$date = date("Y-m-d");
$IP = $_SERVER["REMOTE_ADDR"]; 
$avatar = "http://www.pokemonelite2000.com/sprites/frlgemtr/frlgemtr113.png";
$cash = 250;

if ($submit)
{
   //open database
   $connect = mysql_connect('fdb2.awardspace.com', 'tpnrpg_main', '*********') or die("Couldnt connect");
   mysql_select_db('tpnrpg_main') or die("Couldn't find db");

   $namecheck = mysql_query("SELECT username FROM Users WHERE username='$username'");
   $count = mysql_num_rows($namecheck);
   
   if ($count!=0)
   {
      die("This username has already been taken! <a href='register.php'>Back?</a>");
   }

   //check for existance
   if ($username&&$password&&$repeatpassword)
   {      
      if($password==$repeatpassword)
      {
         //check char length of username and name
         if (strlen($username)>35||strlen($email)>255)
         {
            echo "Length of username or name is too long! <a href='register.php'>Back?</a>";
         }
         else
         {
            //check password length
            if (strlen($password)>100||strlen($password)<6)
            {
               echo "Password must be between 6 and 35 characters <a href='register.php'>Back?</a>";
            }
            else
            {
               //register the user
               //encrypt password
               $password = md5($password);
               $repeatpassword = md5(repeatpassword);

               $queryreg = mysql_query("
                     INSERT INTO Users VALUES('','$username','$password','$IP','$date','','$cash','$avatar')
                     ");
                                             
               die ("You have Successfully been registered! <a href='login.php'>login</a>");      
            }
         }
      }
      else
         echo "Your passwords do not match! <a href='register.php'>Back?</a>";

   }
   else
      echo "Please fill in <b>all</b> fields! <a href='register.php'>Back?</a>";
}

?>

 

 

can you please help thanks

 

[gevans]

Where's you're login script? If everything is successfully added to the database the problem will be there, not in the register script.

[phpwiz]

login2.php

<?php

$username = $_POST['username'];
$password = $_POST['password'];

if ($username)
{

$connect = mysql_connect("fdb2.awardspace.com","tpnrpg_main","********") or die("Could Not connect!");
mysql_select_db("tpnrpg_main") or die("Could Not find DB");

$query = mysql_query("SELECT * FROM Users WHERE username='$username'");

$numrows = mysql_num_rows($query);

if ($numrows!=0)
{

while ($row = mysql_fetch_assoc($query))
{
		$dbusername = $row['username'];	
		$dbpassword = $row['password'];	
}

// check to see if they match
if ($username==$dbusername&&$password==$dbpassword)
{
	echo "You have sucessfully been logged in! <a href='mem.php'>Click here!</a>";
	$_SESSION['username']=$username;	
                $do = mysql_query("INSERT INTO Online VALUES ('$username')");
}
else
	echo "Incorrect password!";

}
else
die("That user Does NOT exist");



}
else
die("Please enter a username and a password!");



?>

 

 

here it is.

 

[Mark Baker]

You need to hash the password that the user has entered to compare against the hashed password value that is stored in the database.

[phpwiz]

You need to hash the password that the user has entered to compare against the hashed password value that is stored in the database.

 

Sorry i didnt understand that.

 

hash?

[gevans]

You don't md5 the password sent to the script....

 

$password = md5($_POST['password']);

[phpwiz]

You don't md5 the password sent to the script....

 

$password = md5($_POST['password']);

 

WHat are you talking about.

[gevans]

WHat are you talking about.

 

What don't you understand.

 

You're comparing a plain text password to a md5 hashed password

[phpwiz]

WHat are you talking about.

 

What don't you understand.

 

You're comparing a plain text password to a md5 hashed password

 

soo what do i put where to fix this?

[Mark Baker]

The password is stored as an md5 hashed value on the database

e.g. a3fcb295b...

The user enters their password as plain text

e.g. bonzo

 

You compare "a3fcb295b..." with "bonzo" and the two values are clearly not the same.

You need to hash the value (bonzo) entered by the user to get its hash value (a3fcb295b...), then compare the two values

if ($username==$dbusername&&md5($password)==$dbpassword)

[gevans]

$password = md5($_POST['password']);

 

Remember that?

 

it goes in place of

 

$password = $_POST['password'];