Members only bit on a website
- Thread starter chrisxuk
- Start date
Soldato
- Joined
- 27 Dec 2005
- Posts
- 17,316
- Location
- Bristol
PHP and MySQL
How would i go about doing this?And also would it be possible to set up a database with say 3 or 4 usernames and password for a members only bit of a website for tomorrow? Thanks
Yer, its a quick thing to do really, even if you follow a tutorial
Also, depending on how secure you need this to be, you should also look into hashing/salting the passwords - have a quick read of robm's php article - explains it very well.
Last edited:
Ok use PHP and MYSQL, Easiest way possible, Use a MD5 encyption on that, use a salt if you want to, but MD5 is unbreakable , then simply use their password they entered use a MD5 encode then match it with the MD5 password already saved on the db then if they match they can login (if the usernames are the same of course).
, then simply use their password they entered use a MD5 encode then match it with the MD5 password already saved on the db then if they match they can login (if the usernames are the same of course).
Soldato
- Joined
- 12 Apr 2004
- Posts
- 11,788
- Location
- Somewhere
Ok use PHP and MYSQL, Easiest way possible, Use a MD5 encyption on that, use a salt if you want to, but MD5 is unbreakable
Wrong! Firstly, MD5 is a hashing algorithm, not an encryption algorithm. Secondly, it's a relatively simple matter to generate collisions for an MD5 digest.
Read the link suarve provided.
Ok use PHP and MYSQL, Easiest way possible, Use a MD5 encyption on that, use a salt if you want to, but MD5 is unbreakable
Without a salt and access to the MD5 you can run the MD5 hash through a dictionary look-up table. It's best practice to salt.
Last edited:
Soldato
- Joined
- 12 Apr 2004
- Posts
- 11,788
- Location
- Somewhere
Ah fair enough didn't realise they could crack it now, guess theres always a way around everything.
Well, that's not the only problem with unsalted hashing: as daz said, it's susceptible to dictionary and rainbow table attacks.
Yeah good point
Just read the link, it's all explained very well.
You only generate a single salt btw....
Soldato
- Joined
- 12 Apr 2004
- Posts
- 11,788
- Location
- Somewhere
Though it's considered best practice to use a per-user salt stored alongside the password.
Soldato
- Joined
- 12 Feb 2006
- Posts
- 17,652
- Location
- Surrey
i can't see this getting done by tomorrow if you don't know what you are doing. even if you go with some premade log-in script it could take you a while to learn to configure it if you have not one bit of php/mysql knowledge.
why by tomorrow? late coursework?
I thought the idea of salting was to have the salt stored somewhere other than your database, effectively making whatever is stored in the database useless without the salt. Surely if your store a salt alongside the hashed password that's just as bad as storing plain text passwords? Or have I missed something major here?
Soldato
- Joined
- 12 Feb 2006
- Posts
- 17,652
- Location
- Surrey
I thought the idea of salting was to have the salt stored somewhere other than your database, effectively making whatever is stored in the database useless without the salt. Surely if your store a salt alongside the hashed password that's just as bad as storing plain text passwords? Or have I missed something major here?
well you could have some sort of script to generate the salt which is based on what is stored in the database. ie generate a random number such as 12392434, store it in database, then have a script which takes 3rd number, times it by 5th and 6th, plus 1st etc. maybe this is bad idea but first thing i could think of. of course will only work for as long as the person doesn't know how to work out the salt from the numbers.