PhP PASSWORD HASHING USING SALT PASSWORD HASHING TECHNIC

[Timothy Steele]

Please i need help i have a voting system which allow me to add user as admin. in the process of adding the user i use a salt password hashing technic and is work perfectly that is when i what to add a user. The problem is that the user can not login and i have try but no way for me. The codes pasted below.

****first if the codes that allow me to add user to the tabase**** add_user.php

<?php
global $db;
// require("../config/db.php");
global $error1, $error2, $error3, $error4;
$full_name = $username = $password = "";


if(isset($_POST['submit'])){
$username = $_POST['username'];
$ad_password = $_POST['password'];
$full_name = $_POST['full_name'];

$sql_query = mysqli_query($db, "SELECT username FROM admin WHERE username = '{$username}' ");
$count = mysqli_num_rows($sql_query);

$sql_salt = mysqli_query($db, "SELECT randSaltPass FROM admin");
$row = mysqli_fetch_array($sql_salt);
$salt = $row['randSaltPass'];
$password = crypt($ad_password, $salt);

if(!empty($username) && !empty($ad_password) && !empty($full_name)){

if($count > 0){
$error1 = "<div class='alert alert-danger'>
<a href='#' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
Username Already Exists.
</div>";
}else{

$u_name = mysqli_real_escape_string($db, $username);
$pass_word = mysqli_real_escape_string($db, $ad_password);
$admin_name = mysqli_real_escape_string($db, $full_name);

if(!preg_match('/^[a-zA-Z]*$/', $u_name)){

$error2 ="<div class='alert alert-danger'>
<a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
Only Leters are Allowed For Username.
</div>";
}
if(!preg_match('/^[a-zA-Z]*$/', $admin_name)){
$error3 ="<div class='alert alert-danger'>
<a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
Only Leters are Allowed For Fullname.
</div>";
}

if(!preg_match('/^\S*(?=\S{7,15})(?=\S*[a-z])(?=\S*[A-Z])(?=\S*[\d])\S*$/', $pass_word)){
$error4 ="<div class='alert alert-danger'>
<a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
Password Must Be Between 7 and 15 Characters and Must Contain At Least One Lowercase Letter one uppercase Letter and One Digit.
</div>";
}


if((preg_match('/^[a-zA-Z]*$/', $u_name)) && (preg_match('/^[a-zA-Z]*$/', $admin_name)) && (preg_match('/^\S*(?=\S{7,15})(?=\S*[a-z])(?=\S*[A-Z])(?=\S*[\d])\S*$/', $pass_word))){


$sql = "INSERT INTO admin(username, password, admin_name) VALUES('{$u_name}', '{$password}', '{$admin_name}' )";

$query = mysqli_query($db, $sql);

if(!$query){
die("QUERY FAILED " . mysqli_error($db));
}

}


}

}else{

if(empty($username)){
$error2="<div class='alert alert-danger'>
<a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
Username Can Be Empty.
</div>";
}
if(empty($full_name)){
$error3="<div class='alert alert-danger'>
<a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
Fullname Can Be Empty.
</div>";
}
if(empty($password)){
$error4="<div class='alert alert-danger'>
<a href='' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
Password Can Be Empty.
</div>";
}

}

}



?>


Second is the code that allow user to login but the problem is i do not Know where i will hash so that user will be able to login

Admin_login.php




class Admin_Login
{
private $_username;
private $_password;

public function __construct($c_username, $c_password) {
$this->_username = $c_username;
$this->_password = md5($c_password);

// $sql_salt = mysqli_query($db, "SELECT randSaltPass FROM admin");
// $row = mysqli_fetch_array($sql_salt);
// $salt = $row['randSaltPass'];
// $password = crypt($db, $salt);
}

public function AdminLogin() {
global $db;

//Start session
session_start();

//Array to validate errors
$error_msg_array = array();

//Error messages
$error_msg = FALSE;

if($this->_username == "") {
$error_msg_array[] = "Please input your username";
$error_msg = TRUE;
}

if($this->_password == "") {
$error_msg_array[] = "Please input your password";
$error_msg = TRUE;
}

if($error_msg) {
$_SESSION['ERROR_MSG_ARR'] = $error_msg_array;
header("location: http://localhost/voting_system/sandbox/index.php");
exit();
}

$sql = "SELECT * FROM admin WHERE username = ? AND password = ? LIMIT 1";
if(!$stmt = $db->prepare($sql)) {
echo $stmt->error;
} else {
$stmt->bind_param("ss", $this->_username, $this->_password);
$stmt->execute();
$result = $stmt->get_result();
}

if($result->num_rows > 0) {
//Login successful
$row = $result->fetch_assoc();

//Create session
session_regenerate_id();
$_SESSION['ADMIN_ID'] = $row["id"];
$_SESSION['ADMIN_NAME'] = $row["name"];
session_write_close();

header("location: http://localhost/voting_system/sandbox/admin_page.php");

} else {
//Login failed
$error_msg_array[] = "The username and password you entered is incorrect.";
$error_msg = TRUE;

if($error_msg) {
$_SESSION['ERROR_MSG_ARR'] = $error_msg_array;
header("location: http://localhost/voting_system/sandbox/index.php");
exit();
}
$stmt->free_result();
}
$result->free();
return $result;
}
}




login.php


<?php
//Include database connection
require("../../config/db.php");

//Include class Admin_Login
require("../classes/Admin_Login.php");

if(isset($_POST['submit'])) {

//Create variable to store post array values
$username = trim($_POST['username']);
$password = trim($_POST['password']);

$adminLogin = new Admin_Login($username, $password);
$rtnAdminLogin = $adminLogin->AdminLogin();

}

[Jerry Stuckle]

On 1/23/2018 4:26 AM, Timothy Steele wrote:
> Please i need help i have a voting system which allow me to add user as admin. in the process of adding the user i use a salt password hashing technic and is work perfectly that is when i what to add a user. The problem is that the user can not login and i have try but no way for me. The codes pasted below.
>

<Snip code>

First of all, you are storing the password in your database in plain
text. This is very insecure; rather store it encrypted. As you have
it, you will never get a match between the plain text password in your
database and an encrypted one from the user.

When you have problems like this, it's often handy to echo the
appropriate values to the screen for debugging. Of course you only do
this on your development system, which is not accessible from the internet.

--
==================
Remove the "x" from my email address
Jerry Stuckle
jstu...@attglobal.net
==================

[J.O. Aho]

On 01/23/18 10:26, Timothy Steele wrote:
> Please i need help i have a voting system which allow me to add user as admin. in the process of adding the user i use a salt password hashing technic and is work perfectly that is when i what to add a user. The problem is that the user can not login and i have try but no way for me. The codes pasted below.
>
> ****first if the codes that allow me to add user to the tabase**** add_user.php

I would recommend you do the hashing in the database layer. Then you
don't need to pull the salt to the php-layer.

> <?php
> global $db;
> // require("../config/db.php");
> global $error1, $error2, $error3, $error4;
> $full_name = $username = $password = "";
>
>
> if(isset($_POST['submit'])){
> $username = $_POST['username'];
> $ad_password = $_POST['password'];
> $full_name = $_POST['full_name'];
>
> $sql_query = mysqli_query($db, "SELECT username FROM admin WHERE username = '{$username}' ");
> $count = mysqli_num_rows($sql_query);
>
> $sql_salt = mysqli_query($db, "SELECT randSaltPass FROM admin");
> $row = mysqli_fetch_array($sql_salt);
> $salt = $row['randSaltPass'];
> $password = crypt($ad_password, $salt);
>
> if(!empty($username) && !empty($ad_password) && !empty($full_name)){
>
> if($count > 0){
> $error1 = "<div class='alert alert-danger'>
> <a href='#' class='close' data-dismiss='alert' aria-label='close'>&times;</a>
> Username Already Exists.
> </div>";
> }else{
>
> $u_name = mysqli_real_escape_string($db, $username);
> $pass_word = mysqli_real_escape_string($db, $ad_password);

What's the point of this? $pass_word is just used in a regex and you
don't need to mysql escape it when you don't use it in the SQL.

Password ain't salted, so you can't compare that to the result from
crypt() which could use something else than md5 (md5 ain't safe to use
for passwords, use at least sha2).

quite bad if you have an ending/starting space in your password.

>
> $adminLogin = new Admin_Login($username, $password);
> $rtnAdminLogin = $adminLogin->AdminLogin();
>
> }
>

--

//Aho

[J.O. Aho]

On 01/23/18 14:01, Jerry Stuckle wrote:
> On 1/23/2018 4:26 AM, Timothy Steele wrote:
>> Please i need help i have a voting system which allow me to add user
>> as admin. in the process of adding the user i use a salt password
>> hashing technic and is work perfectly that is when i what to add a
>> user. The problem is that the user can not login and i have try but no
>> way for me. The codes pasted below.
>>
> <Snip code>
>
> First of all, you are storing the password in your database in plain
> text.  This is very insecure; rather store it encrypted.  As you have
> it, you will never get a match between the plain text password in your
> database and an encrypted one from the user.
>
> When you have problems like this, it's often handy to echo the
> appropriate values to the screen for debugging.  Of course you only do
> this on your development system, which is not accessible from the internet.

The code is bad, but the password ain't stored in plain text.

--

//Aho

[nandini...@gmail.com]

Hash algorithms are one way functions. They turn any amount of data into a fixed-length "fingerprint" that cannot be reversed. They also have the property that if the input changes by even a tiny bit, the resulting hash is completely different (see the example above). This is great for protecting passwords, because we want to store passwords in a form that protects them even if the password file itself is compromised, but at the same time, we need to be able to verify that a user's password is correct.
https://www.besanttechnologies.com/training-courses/other-training-courses/digital-marketing-training-institute-in-chennai

[Jerry Stuckle]

On 1/25/2018 7:11 AM, nandini...@gmail.com wrote:
> Hash algorithms are one way functions. They turn any amount of data into a fixed-length "fingerprint" that cannot be reversed. They also have the property that if the input changes by even a tiny bit, the resulting hash is completely different (see the example above). This is great for protecting passwords, because we want to store passwords in a form that protects them even if the password file itself is compromised, but at the same time, we need to be able to verify that a user's password is correct.
> https://www.besanttechnologies.com/training-courses/other-training-courses/digital-marketing-training-institute-in-chennai
>

Go away, SPAMMER!

[careenj...@gmail.com]

There are a lot of conflicting ideas and misconceptions on how to do password hashing properly, probably due to the abundance of misinformation on the web. Password hashing is one of those things that's so simple, but yet so many people get wrong. With this page, I hope to explain not only the correct way to do it, but why it should be done that way.
http://www.trainingbangalore.in/hadoop-training-in-bangalore.html

[J.O. Aho]

On 03/01/18 12:20, careenj...@gmail.com wrote:
> There are a lot of conflicting ideas and misconceptions on how to do password hashing properly, probably due to the abundance of misinformation on the web. Password hashing is one of those things that's so simple, but yet so many people get wrong. With this page, I hope to explain not only the correct way to do it, but why it should be done that way.

> http://www.indianspammer.example.net/some-third-grade-training-in-bangalore.html

Thanks for the utter crap from India, a good advice is to ignore sites
located in India or articles written by Indians and you have got rid of
70% of bad solutions.

[Arno Welzel]

Jerry Stuckle:

[...]

> When you have problems like this, it's often handy to echo the
> appropriate values to the screen for debugging. Of course you only do
> this on your development system, which is not accessible from the internet.

Even better is to use a debugger.


--
Arno Welzel
https://arnowelzel.de
https://de-rec-fahrrad.de
http://fahrradzukunft.de

[Tony Mountifield]

In article <fv9fe0...@mid.individual.net>,

Arno Welzel <use...@arnowelzel.de> wrote:
> Jerry Stuckle:
>
> [...]
> > When you have problems like this, it's often handy to echo the
> > appropriate values to the screen for debugging. Of course you only do
> > this on your development system, which is not accessible from the internet.
>
> Even better is to use a debugger.

What debuggers are available for PHP running on a LAMP stack?

Cheers
Tony
--
Tony Mountifield
Work: to...@softins.co.uk - http://www.softins.co.uk
Play: to...@mountifield.org - http://tony.mountifield.org

[Christoph M. Becker]

On 05.09.2018 at 12:19, Tony Mountifield wrote:

> In article <fv9fe0...@mid.individual.net>,
> Arno Welzel <use...@arnowelzel.de> wrote:
>
>> Jerry Stuckle:
>>
>> [...]
>>> When you have problems like this, it's often handy to echo the
>>> appropriate values to the screen for debugging. Of course you only do
>>> this on your development system, which is not accessible from the internet.
>>
>> Even better is to use a debugger.
>
> What debuggers are available for PHP running on a LAMP stack?

<https://xdebug.org/> is generally recommendable. You also may want to
have a look at <http://php.net/manual/en/book.phpdbg.php>.

--
Christoph M. Becker

[bill]

does phpdbg need to be included via php.ini or ??
The manual on installation is a bit terse.

bill

[Christoph M. Becker]

The manual is still very incomplete.
<https://phpdbg.room11.org/introduction.html> should descibe some
missing details.

--
Christoph M. Becker

[Jerry Stuckle]

On 9/5/2018 6:41 AM, Christoph M. Becker wrote:

xdebug is not a debugger itself. It is simply an interface into the PHP
code. You need an additional product such as Eclipse to debug the code.
And that can be difficult to set up the first time, especially if
you're debugging a remote system (and if you are debugging a remote
system you need the same source code on both your local and remote system).

This is why I suggested he simply echo the values to the screen. It's
quick and easy, especially for a beginner.

[bill]

Thank you very much
-bill

[bill]

AS I have done. I have a tiny library of routines to "pretty"
show variables.

[Arno Welzel]

Tony Mountifield:

> In article <fv9fe0...@mid.individual.net>,
> Arno Welzel <use...@arnowelzel.de> wrote:
>> Jerry Stuckle:
>>
>> [...]
>>> When you have problems like this, it's often handy to echo the
>>> appropriate values to the screen for debugging. Of course you only do
>>> this on your development system, which is not accessible from the internet.
>>
>> Even better is to use a debugger.
>
> What debuggers are available for PHP running on a LAMP stack?

Visual Studio Code and XDebug:

<https://code.visualstudio.com>
<https://xdebug.org>

Yes, Visual Studio Code is by Microsoft - but it's Open Source and based
on Electron and can therefore be used with Windows, macOS and Linux.
There are also extensions for PHP debugging:

<https://code.visualstudio.com/docs/languages/php>

[Härra Ramob]

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ

ʕʘ̅͜ʘ̅ʔ