Login not working with blowfish hashing

Question

function sanitizeMySQL($conn, $var)
{
    $var = $conn->real_escape_string($var); 
    $var = sanitizeString($var);return $var;
}


function sanitizeString($var)
{
    $var = (null !== (get_magic_quotes_gpc()))?stripslashes($var):null;
    $var = strip_tags($var);
    $var = htmlentities($var);
    return $var;
}

This is the code used.

<?php

$email = trim($_POST['login_email']);
$pwd= trim($_POST['login_pwd']);

//sanitize datas
$email = sanitizeMySQL($conn, $email);
$pwd = sanitizeMySQL($conn, $pwd);

$sql1 = mysqli_query($conn, "SELECT * FROM login_tbl WHERE email = '$email' limit 1");
$row1 = mysqli_fetch_array($sql1);
$dbpwd = $row1['password'];

if(crypt($pwd,$dbpwd) == $dbpwd){
    //ok
    $msg = "Welcome Customer";
}else{
    //error
    $msg = "Invalid Email / Password.";
}
echo $msg."<br>".$pwd."<br>".crypt($pwd,$dbpwd)."<br>".$dbpwd;

And the result i got was

Invalid Email / Password. $2y$10$C9X8hwHa4uhI5tm9r72tIuqZSButX6C3/zlR8oJs3tW.SQscROvuO $2y$10$C9X8hwHa4uhI5tm9r72tIufRykhvdmSXR/.4CpDg/.7UpJi3ITu6e

The sanitizeMySQL() function calls a function in the function page

Any specific reason for using this and not `password_hash($password, PASSWORD_BCRYPT);` ? — Rotimi, May 31 '18 at 12:05
**WARNING** : your code is vulnerable to SQL injections : you MUST NOT use raw user input in a query. Look for prepared statements. — ᴄʀᴏᴢᴇᴛ, May 31 '18 at 12:09
Possible duplicate of [Secure hash and salt for PHP passwords](https://stackoverflow.com/questions/401656/secure-hash-and-salt-for-php-passwords) — Rotimi, May 31 '18 at 12:12
You have a syntax error here `$msg = "Welcome Customer;info=".$msg);` — Rotimi, May 31 '18 at 12:13
The `crypt()` part of this code is nonsense. You are using the encrypted password from the database as the SALT for running the `crypt()`. You will never get a matching output that way. Use `password_hash()` and `password_verify()` they use the same encryption but ensure a strong SALT automatically. It looks like you are using `password_verify()` logic in this code anyway — RiggsFolly, May 31 '18 at 12:13

score 0 · Accepted Answer · answered May 31 '18 at 13:19

this worked finally

<?php
require_once("functions.php");
require_once ("db_connection.php");

$var = "@Me12345";
sanitizeMySQL($conn, $var);

$options = [
    'cost' => 10,
    'salt' => mcrypt_create_iv(22, MCRYPT_DEV_URANDOM),
];

$hash = password_hash($var, PASSWORD_BCRYPT, $options);
echo $var ." ". $hash;
var_dump(password_verify($var, $hash));
?>

score -5 · Answer 2 · answered May 31 '18 at 12:07

-5

Try this

$email = $_POST['login_email'];
$pwd= $_POST['login_pwd'];


$sql1 = mysqli_query($conn, "SELECT * FROM login_tbl WHERE email = '$email' limit 1");
$row1 = mysqli_fetch_array($sql1);
$dbpwd = $row1['password'];

if(crypt($pwd,$dbpwd) == $dbpwd){
    //ok
    $msg = "Welcome Customer"; 
}else{
    //error
    $msg = "Invalid Email / Password.";
}
echo $msg."<br>".crypt($pwd,$dbpwd)."<br>".$dbpwd;

answered May 31 '18 at 12:07

NSJ

13
7

1

maybe also add some explanation as well as what you changed? This looks like a copy & paste – Rotimi May 31 '18 at 12:07
1

I'm not sur it is quite good to give a "solution" without any explanation, especially when the code is weak to sql injection... – Zyigh May 31 '18 at 12:09
Check the if, else statements. Hope it's not a such lengthy code that need much explanation. Does it work for you now? – NSJ May 31 '18 at 12:12
The basic logic is incorrect. The use of `crypt()` is the bit thats all messed up – RiggsFolly May 31 '18 at 12:17
$msg = "Welcome Customer;info=" . $msg); This line contains "info=" . $msg); " which may be you have copied from somewhere else and not intentionally using here – NSJ May 31 '18 at 12:19
@Nadum But that has nothing really to do with the actual problem in this code – RiggsFolly May 31 '18 at 12:19
@RiggsFolly, basically that quoted part prevent the `if, else` working properly. Whatever change we make in the other parts it will echo the final assignment here. May be there's something with `crypt()` also. So we need to correct the both. – NSJ May 31 '18 at 12:23
i changed the hashig method to password_hash() and the validation to password_verify() and its still not working – Ebuka May 31 '18 at 12:49

Login not working with blowfish hashing

2 Answers2