php盐身份验证

Question

Thank you for your honest criticism towards my ignorance in php/mysql and I appreciate your help concerning this issue.

After making the corrections suggested below I'm running into the issue where the registered

sha1(md5($password).$salt) 

is not === when compared to the login authentication

sha1(md5($password).$row['salt']); 

So I created a script to see what the login script was seeing and it compares the two.

 $query = "UPDATE `users` SET `form_password` = '$encrypted'  WHERE `username` = '$username'";  
     mysql_query($query) or die (mysql_error());

password is registered as "1fcb4bdeb8a98151f5f74a2af0b5045ec277c501"

and being called back as "f2c04d2583f111fcd41288dc75901f6c870cfc6b"

Here is the updated script on login:

else {  

$password = $_POST['password'];
$username = mysql_real_escape_string($_POST['username']);


$sql  =  "SELECT `password`, `salt` FROM `users` WHERE `username` = '$username' LIMIT 0,1";
$result = mysql_query($sql) or die(mysql_error());

if (is_resource($result) && mysql_num_rows($result) > 0){
    $row        =   mysql_fetch_array($result);
    $encrypted  =   sha1(md5($password).$row['salt']);

     if($encrypted === $row['password']){
    header('Location: page3.php');
    exit;
     } else{

     $query = "UPDATE `users` SET `form_password` = '$encrypted'  WHERE `username` = '$username'";  
     mysql_query($query) or die (mysql_error());

    header('Location: page2.php');
    exit;
     }
} else{
header('Location: page4.php');
exit;
}
}

Answer 1

a) How large is your password field in the database? SHA1 hashes are 40 characters long, so if you've got a field size less than that, your hashed password will be truncated.

b) Putting or die() on your $sql = ... line is pointless. Creating a string is extraordinarily unlikely to fail. You need to put the or die() on the line where the query is actually executed:

$sql = "..."
$result = mysql_query($sql) or die(...);

c) Your code is vulnerable to sql injection, as you paste the user-provided username and password directly into your queries without escaping.

d) You don't check if the query to get the user's pw/salt succeeds. If the username is incorrect, the query will retrieve no rows. This isn't an error condition, as the query did what it was supposed to. You need to check, via mysql_num_rows($result) if the query did return a row or not.