加密盐加密登录[关闭]

Question

I am sure this might be simple for someone but well.

It is hard for me, I want to make a login using ispconfig client info and it works well except the password needs to match the ispconfig password which uses a crypt / salt encryption as far as I know how would i match this with the password the user enter?

So far I have this but i does not seem to work:

$clientPassword = $_POST['password'];
$selectUserPass = mysqli_query($con, "SELECT * FROM client");
$Passcollected = stripslashes($selectUserPass['password']);
$salt = '$1$'.substr($saved_password, 3, 8).'$';
$clientPasswordSafe = crypt(stripslashes($clientPassword), $salt);

Thanks!

Answer 1

If the password was really hashed with the crypt() function, then you could verify it like this:

$clientPassword = $_POST['password'];
$selectUserPass = mysqli_query($con, "SELECT * FROM client");
$Passcollected = $selectUserPass['password'];
$isPasswordCorrect = crypt($clientPassword, $Passcollected) === $Passcollected;

Or even easier with the new password function:

$clientPassword = $_POST['password'];
$selectUserPass = mysqli_query($con, "SELECT * FROM client");
$Passcollected = $selectUserPass['password'];
$isPasswordCorrect = password_verify($clientPassword, $Passcollected);

Note that i did not use the stripslashes() function, escaping is not necessary before hashing. The salt is part of the stored hash and will be extracted automatically by the verifying function.