MySQL和PHP - 密码比较

Question

I'm using a stored procedure to check the username and password on login attempts. - The passwords are stored using the password() function in MySQL.

And the login works fine, using the stored procedure, the problem is that I have a function that enables the user to change the password, how should I update it? as MD5 through PHP? or should I build a new stored procedure?

Thanks :)

Answer 1

You're not supposed to use the PASSWORD() function for your application-level passwords.

http://dev.mysql.com/doc/refman/5.6/en/encryption-functions.html#function_password says:

Note
The PASSWORD() function is used by the authentication system in MySQL Server; you should not use it in your own applications. For that purpose, consider MD5() or SHA2() instead. Also see RFC 2195, section 2 (Challenge-Response Authentication Mechanism (CRAM)), for more information about handling passwords and authentication securely in your applications.

If you use a standard cryptographic hash method like SHA2, you can perform the hashing in PHP, using the hash extension. Hashes calculated with the same algorithm in PHP are compatible with those calculated in MySQL.