检查输入的密码是否正确，与PHP中的sha256 pw匹配

Question

I have a password;

828b8f98ec52c750bf018c92951c6e40ae3976e74c888e42ff55ff22403932af

I am using Kohana 3 for my Auth login normally.

now i need to make a separate script, where a client can enter his password only and then it should check if the password it correct.

So what im dealing with is:

$real_pwd = '828b8f98ec52c750bf018c92951c6e40ae3976e74c888e42ff55ff22403932af';
$entered_pwd = $_GET['pwd']; // test purposes i know its vuln for sql injection ...

if ( $real_pwd == crypt($entered_pwd) ) { echo "OK"; }

This is not working ofcourse, crypt() is something i tried, but i dont know what to use?

If it was a sha1 pw i could use sha1 for the entered_pwd, but what with sha256?

Answer 1

You could use hash() http://php.net/manual/en/function.hash.php

However I recommend you to have a look at bcrypt and use it for hashing password. Have a look here How do you use bcrypt for hashing passwords in PHP?

Here's some other resources you might find useful: Secure hash and salt for PHP passwords

Fundamental difference between Hashing and Encryption algorithms