MD5 problems

[OuisVN]

I need help

 

i need remove all md5 and others hashings in this codes

 

Validate: http://pastebin.com/wLENt5df

 

and Register/Login: http://pastebin.com/gG0fK7ys

 

 

In register/login i remove md5

 

$loginKey = md5(time() . json_encode($_POST)); to $loginKey = time() . json_encode($_POST); AND 'password' => $mysql->hash($_POST['pass']), to 'password' => $mysql->$_POST['pass'],

 

but i need remove md5 in validate, please help me

[QuickOldCar]

What you should do instead is use pdo with prepared statements, password_hash() and password_verify()

[OuisVN]

what I want is to remove me because it has generated many problems. Saved password that is such which entered.

I hope you can help me.

[0x00]

As you call hash(), the third parameter lets you specify the algorithm.

[OuisVN]

1. static function hash($str, $rawsalt = '', $hash = 'sha512')

2.         {

                if($rawsalt == '')

                {

                        $rawsalt = self::rand(((strlen($str) % 3) + 1) * 5);

                }

               

                $loc = array(hash('sha1', $rawsalt), hash('sha1', $str), '');

                foreach(str_split($loc[0], 1) as $index => $character)

                {

                        $loc[2] .= $character . $loc[1][$index];

                }

               

                $hash = hash($hash, $loc[2]);

                return substr_replace($hash, $rawsalt, (strlen($str) << 2) % strlen($hash), 0);

        }

       

        static function validate($str, $hash, $engine = 'sha512')

        {

                $salt = substr($hash, (strlen($str) << 2) % strlen(hash($engine, 1)), ((strlen($str) % 3) + 1) * 5);

                return self::hash($str, $salt, $engine) === $hash ? true : false;

        }

 

 

 

I need remove hash, sha512, md5 and other hashings without damage code

 

[QuickOldCar]

I see you are using pdo, my question is how would you make an accurate comparison if changed it now.

 

Rewrite it and do it the more secure way, email your users to make a new password.

[0x00]

@OuisVN, er... are you wanting to store the password without hashing it? That really isn't the way to do it, mainly because its insecure...

[OuisVN]

it's just for a project, for that reason I want to remove the md5.

[sKunKbad]

If these are user passwords to a site where the login is an email address w/ password, then there really is no harm in deleting everyone's password as long as there is a password reset feature. You'd really want to enforce the new stronger passwords anyway.