How to add Password Security?

[booxvid]

How to have password encryption and password salting in your login?

[xyph]

Check out the article in my signature. It's very in-depth, up to date, and the methods used are very secure.

[booxvid]

I already had this snippet code in adding users

 

	if(isset($_POST['add_user'])){
	$passw = trim(htmlentities($_POST['password']));

	$encrypted = enc_salt($passw);

	$con = "true";
		$sql = "SELECT * FROM users WHERE username='".$_POST['user_name']."'";
		$result = $database->query($sql);
		$row = $database->fetch_array($result);

		if($row!=""){
			$con="false";
		}

	if($con!="false"){	
	 $sql  = "INSERT INTO photo_gallery.users (username, password, first_name, last_name)";
	$sql .= " VALUES ('".trim(htmlentities($_POST['user_name']))."','".$encrypted."', '".trim(htmlentities($_POST['first_name']))."', '".trim(htmlentities($_POST['last_name']))."')";

	$result_set = $database->query($sql);

	echo '<script type="text/javascript">alert("Account Created!");</script>';}
	else{
		echo '<script type="text/javascript">alert("This username already exist!");</script>';
	}
}

 

where my function enc_salt is:

function enc_salt($string){
//encrypting
$pass_word = sha1($string);
$salt = md5("user");
$pepper = "cxlkdawpoalsk";

$pass_encrypted = $salt.$pass_word.$pepper;
return $pass_encrypted;
}

 

my problem right now is when it's time the user login to the website.

[xyph]

That's not a very strong hashing algorithm.

 

Again, you should check out the article in my signature.

[krash11554]

I think you would take what the user puts in the password field when logging in and do the same encryption you did when the user registers and then compare the two passwords.

[booxvid]

That's not a very strong hashing algorithm.

 

Again, you should check out the article in my signature.

 

Yeah, but for the meantime I would like to fix the error that I made from my program 

[booxvid]

I think you would take what the user puts in the password field when logging in and do the same encryption you did when the user registers and then compare the two passwords.

 

I already do the same method but it isn't successful.

[Christian F.]

"In the meantime", as in "while you're reading that article and absorbing its knowledge", don't do anything with your script. If you've pushed it to production, take it down. Once you've read and understood the article, then go back and fix the script before uploading it again.

If you don't, then you're only causing problems for yourself and (what's worse) your users.

[maxudaskin]

I already had this snippet code in adding users

 

	if(isset($_POST['add_user'])){
	$passw = trim(htmlentities($_POST['password']));

	$encrypted = enc_salt($passw);

	$con = "true";
		$sql = "SELECT * FROM users WHERE username='".$_POST['user_name']."'";
		$result = $database->query($sql);
		$row = $database->fetch_array($result);

		if($row!=""){
			$con="false";
		}

	if($con!="false"){	
	 $sql  = "INSERT INTO photo_gallery.users (username, password, first_name, last_name)";
	$sql .= " VALUES ('".trim(htmlentities($_POST['user_name']))."','".$encrypted."', '".trim(htmlentities($_POST['first_name']))."', '".trim(htmlentities($_POST['last_name']))."')";

	$result_set = $database->query($sql);

	echo '<script type="text/javascript">alert("Account Created!");</script>';}
	else{
		echo '<script type="text/javascript">alert("This username already exist!");</script>';
	}
}

 

where my function enc_salt is:

function enc_salt($string){
//encrypting
$pass_word = sha1($string);
$salt = md5("user");
$pepper = "cxlkdawpoalsk";

$pass_encrypted = $salt.$pass_word.$pepper;
return $pass_encrypted;
}

 

my problem right now is when it's time the user login to the website.

 

Very ineffective salting method.

 

Try this:

function enc_salt($password) {
    $salt = 'somerandomecharacters1646#s@0-2 da2e/5ad+';
    return md5($password . $salt);
}

[xyph]

Very ineffective salting method.

 

Try this:

function enc_salt($password) {
    $salt = 'somerandomecharacters1646#s@0-2 da2e/5ad+';
    return md5($password . $salt);
}

 

Yours is ineffective as well. Salts should be random and unique per user.