crypt()

[182x]

Hey guys, I have developed a login script where the users passwords are stored in the db using the crypt method of encryption. I was just wondering is the following the correct way to assign the encrypted data to a variable so it can be compared in a query? or will this method fail as it is one way encryption?

 

$password  = crypt($_POST['password'], 'salthere);
//sql here i.e select * from user where uname=$uname and password=$password;

[lightningstrike]

Remember that crypt is NOT encryption but rather a one-way hash. As long as the DB stores the hashes your method should work fine.

[182x]

Thanks for the reply, does the hash code have to be specifically put into the DB or is it ok to just put the variable into the db once the hash has been performed for this method to work?

[Fadion]

Never used crypt(), im more confident with md5 or sha1. Also from what ive read (correct me if im wrong), crypt() hashes only the first 8 characters, so you cant use it for passwords longer then 8 chars.