Login system from scratch

PHP
1

I’m creating a login function for my site,
http://fixmysite.us/DFI/login.html

Username:Paul_Magnatto
Password: letmein

Here is my table
CREATE TABLE members (
id SMALLINT NOT NULL AUTO_INCREMENT,
PRIMARY KEY(id),
username VARCHAR(50),
password CHAR(50)
);

And here is my insert statement

INSERT INTO members (id,username,password) VALUES (1,“Paul_Magnatto”,md5(“letmein”));

I’ve heard that md5() is not a very good encryption method to use, what method should I use to use better encryption?
Is there a primer out there to help me learn how to do it?

Thanks

2

Do you at least have PHP5.5? If so, then password_hash
http://php.net/manual/en/function.password-hash.php

3

There is also code available that allows it to be implemented on 5.3 - then when you upgrade to 5.5 you simply remove the extra file containing that code.

5

my PHP version is 5.3.28,

so I gather an option according to http://www.sitepoint.com/password-hashing-in-php/
is

    <?php
$password = hash("sha256", $password);

I was looking for the code for the lesser version of PHP, but couldn’t find it

6

So use the version from https://github.com/ircmaxell/password_compat/tree/master/lib

Then when you upgrade to 5.5 you simply delete that file and the functions will continue to work as that code will then be built into PHP

7

Yes, use the ircmaxell password_compat library as @felgall noted.

One thing to point out though is that you should avoid trying to create your own salt. Just let bcrypt do it for you as it will provide a very good salt for you.

Also, you’ll need to “widen” the password column as CHAR(50) won’t be enough. I’d actually go straight for VARCHAR(255) so that you’re “future-proofed” if the recommended algo changes and that one yields a longer hash.

8

my PHP version is 5.3.28,

so I gather an option according to http://www.sitepoint.com/password-hashing-in-php/
is

    <?php
$password = hash("sha256", $password);

I was looking for the code for the lesser version of PHP, but couldn’t find it

er rather should I use it like on

9

Yes,

simply copy the password.php file from there and include that in the scripts you want to do password processing. You then write your actual password processing the way the php.net web site says to use for PHP 5.5+ as the file you are adding provides compatible functions for those calls. When you then filally upgrade to 5.5 you just delete the include statement.

10

HI,
i am also about to do similar although i have found PH-Pass which does all the hard work for you from what i can tell https://sunnyis.me/blog/secure-passwords and uses similar encryption to that which is used in the later versions of Drupal.

The other things you should consider adding to your table if this is for more users than just yourself are:

Creation date - so you know when someone registered
last login date - so you know when they last logged in
account type - is it a general user or admin
email - you’ll need to send out password reminders etc

and probably a few other things i can’t remember.

11

This topic was automatically closed 91 days after the last reply. New replies are no longer allowed.