Hi! This is my 2nd code of PHP + MySQL.
This code is VERY simple: it encript the data in the MySQL DB. Here we go!
------------------------------------------------------------------------

The password "abc" was codfied using md5()
This will be: 900150983cd24fb0d6963f7d28e17f72

This check if the password in the var is the "same" as the password in the DB

Very nice.
Very useful, because doing that way you store in the database only enkripted passwords. So, people reading your database will not be able to retrieve the password.
I only wonder about something. md5 is a stand way of enkrypting. Is there a reverse method, able to retrieve "abc" from md5(abc) ?
Regards
Yordan

No, that is why it is encrypted in the first place, md5 encryption produces a 32 bit hash of the string referred to as a variable, but there is no reverse at least in PHP functions, if there were then all encrypted data would be useless. If you visit some sites that use md5 and you lose your password they can only issue another password due to the fact that md5 is irreversable, you could of course send them their md5 hash but it has to match with the password that it origionally encrypted and I doubt they would be happy with a new password of 1f3870be274f6c49b3e31a0c6728957f which is the md5 encrytion of 'apple'

Would you like it if a webmaster or other admin of a site had your password, even if he cared about it, or would you feel more comfortable knowing that your password were encrypted and very difficult to match even using brute force?

Noway, I'm familiar with the fact that the system admin simply resets passwords. And the database admin don't need user's passwords, he can directly read the data from your tables so he does not need to know your password. I was just curious about the way to do that, I never did it by myself. I usually work with oracle, and i simply give a user a password, ask the user to change his password, and then reset the password because the user lost it.

MD5 Encription
[PHP + MySQL] Encrypting Data

Replying to Houdini

This Encription is not safe Because You can easly Find The Decripted data within a single search

Md5 decription e358efa489f58062f10dd7316b65649e

Search the above word in google you will get the decripted data. So Use some simple Private encription For Better Security

-reply by ManuMadanan

-----admin opinion-----
spam.

That's exactly why your passwords should be more complex and not as simple as 't' ...
Find these ones for me will you:
9571f61c4138bb26c46baceda4b750c8
f2de268dc779a73c6de9e25d61a4da1f
f8b3685e8f0ca7ef4c00d599866d65dc
18191ad14376f315b9403a108dd745d4

sweet

You know what ? I did this google search. And the answer was : this topic !

When using just simple md5() isn't very safe these days, thats way it's much better to do a random seed and generate random strings with md5 or something, which will always be the same to look, for example I have a function like this somewhere in my scripts which is a much better way to check the password and encrypt it, normally there is no way to decrypt unless you're a tough hacker or something..

It's really quite a complex thing, but when you understand that it does when you think, wow how this is simple an brilliant



To tell it shortly, it hashes every word and letter and hashes all those hashes into one string, I use a little bit other technique on my CMS, so I won't tell it publicly, because you can change something a little by changing some numbers and you'll get quite different results, those who knows PHP will know what it does, there are even some comments to understand its functionality..

To use them, you can do just as top post, by using some if statement and calling the functions like this:



If you want to encrypt the password or store it to the database, you can just do it by using the other function:



You'll see that every time you get quite different random hashed string, but the meaning is the same, when you check it with the check function, it returns true all times if the words meant the same..

To continue. why using only md5() isn't safe, because there are software for hackers which have most popular dictionaries hashed with md5() for all the words on different languages and most popular symbol and numbers with letters and they take up several GB or a TB and they use it to check check with a loop, of course to prevent that you can just do a check by logging how much he tries to login or only let your php script login everyone in a timestamp of half second or do a sleep function for everyone for a second, there are much ways you can avoid this, even if the hacker has a lot of ips to use..

Nonetheless, using md5 still isn't a great course of action. md5 has already been cracked, so really, does anyone want to take the chance with important data? I think quatrux's method with a salt is very useful--makes it quite difficult for crackers to obtain the actual password. On another note, php also has many other functions for encryption besides md5 (unfortunately, this is only available to php 5.1.2 and above...sad). With 5.1.2, there's a function called hash:



The $algo can be any from a long list of hash functions, including but not limited to 'sha256' (which I think is the new government standard after sha1 was kicked out of use due to it being cracked), ripemd160, whirlpool etc. Php also provides a full list of its supported hash functions with the function hash_algos (http://us2.php.net/manual/en/function.hash-algos.php). The list looks something like this:



So, yes, with php 5, there are quite a variety of hash functions to choose from, including extremely secure (currently un-cracked) ones. However, if you're stuck with php 4, there's always the sha1 function, which is still quite a ways better than md5 for mid-level security things.