sha1() for Password hashing
php
Solution
First is first. NEVER USE SHA OR MCRYPT TO STORE YOUR PASSWORD.
EDIT : The `password_hash()` function generates a long password hash, so make sure that your column in the mysql is a `VARCHAR` of 500 space
All these useless practises is the root reason why almost many websites get hacked. To tackle the situation, php did a lot of research and then at last came with the most secure function called the `password_hash()`. I am not more onto explaining about `password_hash()` here as there are already many documents on the internet.
You can always hash a password like this
<?php
$securePassword = password_hash($_POST['password'], PASSWORD_DEFAULT);
$query = $db->query('INSERT INTO users ......');
?>
And, to verify the password, you can simply use this function
<?php
$passwordHash = $query['password']; //Password from database
$userPassword = $_POST['password']; //Password from form
if(password_verify($userPassword, $passwordHash)) {
echo 'Password is correct, logged in!';
} else {
echo 'Password is wrong, try again';
}
?>
And, answer for your question.
PLEASE DON'T USE SHA OR MCRYPT OR BCRYPT. IF YOU WANNA GET YOUR WEBSITE HACKED, THEN CONTINUE. OR USE `password_hash()`
The reason you don't get the hash genereated each time because the `openssl_random_pseudo_bytes()` generates random numbers each time. So each time, during execution, the function returns different numbers and you get your `sha` result wrong and thus giving a `FALSE` alert.
PLEASE, AGAIN. I BEG YOU TO USE `password_hash()` FUNCTION
For more information on `password_hash()` and `password_verify()` :
- http://php.net/manual/en/function.password-hash.php
- http://php.net/manual/en/function.password-verify.php
Problem
I am using sha1 for my password security. I have stored password in this way in register.php ``` // secure password $salt = openssl_random_pseudo_bytes(20); $secured_password = sha1($password . $salt); //Send it to mysql table $result = $access->registerUser($username, $secured_password, $salt, $email, $fullname); ``` This all is working fine. Problem is here: In my login.php ``` $password = htmlentities($_POST["password"]); $secure_password = $user["password"]; $salt = $user["salt"]; // 4.2 Check if entered passwords match with password from database if ($secure_password == sha1($password . $salt)) { //do something } else { //do something } ``` I am always getting as password does not match. where am I going wrong?