| | |
Password encoding/decoding
Please support our PHP advertiser: PostgreSQL or MySQL? Compare and contrast the two most popular open source databases
![]() |
•
•
Join Date: Jul 2007
Posts: 23
Reputation:
Solved Threads: 3
I am currently building an online system, it has come to the point to think about securing peoples passwords. How ever, for admin reasons I was wondering if it was possible to decode the encoded password, I believe this is not possible with md5 but hoping there is another method?
Any help would be geat, also any other information regarding safety, thanks.
Any help would be geat, also any other information regarding safety, thanks.
Here is a good PHP5 class that uses the mcrypt library for two way encryption.
php Syntax (Toggle Plain Text)
<?php class Encryption { static $cypher = 'blowfish'; static $mode = 'cfb'; static $key = '1a2s3d4f5g6h'; public function encrypt($plaintext) { $td = mcrypt_module_open(self::$cypher, '', self::$mode, ''); $iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), MCRYPT_RAND); mcrypt_generic_init($td, self::$key, $iv); $crypttext = mcrypt_generic($td, $plaintext); mcrypt_generic_deinit($td); return $iv.$crypttext; } public function decrypt($crypttext) { $plaintext = ""; $td = mcrypt_module_open(self::$cypher, '', self::$mode, ''); $ivsize = mcrypt_enc_get_iv_size($td); $iv = substr($crypttext, 0, $ivsize); $crypttext = substr($crypttext, $ivsize); if ($iv) { mcrypt_generic_init($td, self::$key, $iv); $plaintext = mdecrypt_generic($td, $crypttext); } return $plaintext; } } // Encrypt text $encrypted_text = Encryption::encrypt('this text is unencrypted'); // Decrypt text $decrypted_text = Encryption::decrypt($encrypted_text); ?>
Last edited by stymiee; Oct 15th, 2007 at 11:48 am.
John Conde
Brainyminds | Merchant Account Services | I Love Code
IT'S HERE: Merchant Accounts 101 Everything you need to know about merchant accounts!
Brainyminds | Merchant Account Services | I Love Code
IT'S HERE: Merchant Accounts 101 Everything you need to know about merchant accounts!
It can be changed to work with PHP 4. You just need to change the PHP 5 features to 4:
php Syntax (Toggle Plain Text)
<?php class Encryption { var $cypher = 'blowfish'; var $mode = 'cfb'; var $key = '1a2s3d4f5g6h'; function Encryption() { // do nothing } function encrypt($plaintext) { $td = mcrypt_module_open($this->cypher, '', $this->mode, ''); $iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), MCRYPT_RAND); mcrypt_generic_init($td, $this->key, $iv); $crypttext = mcrypt_generic($td, $plaintext); mcrypt_generic_deinit($td); return $iv.$crypttext; } function decrypt($crypttext) { $plaintext = ""; $td = mcrypt_module_open($this->cypher, '', $this->mode, ''); $ivsize = mcrypt_enc_get_iv_size($td); $iv = substr($crypttext, 0, $ivsize); $crypttext = substr($crypttext, $ivsize); if ($iv) { mcrypt_generic_init($td, $this->key, $iv); $plaintext = mdecrypt_generic($td, $crypttext); } return $plaintext; } } ?>
John Conde
Brainyminds | Merchant Account Services | I Love Code
IT'S HERE: Merchant Accounts 101 Everything you need to know about merchant accounts!
Brainyminds | Merchant Account Services | I Love Code
IT'S HERE: Merchant Accounts 101 Everything you need to know about merchant accounts!
•
•
Join Date: Oct 2009
Posts: 102
Reputation:
Solved Threads: 18
0
#6 Nov 5th, 2009
You can do it at the database level as well if you want.
For INSERT
And for SELECT
You'll have to keep the AES key as a config value or something. If you lose it you can't decrypt the data
More references here.
For INSERT
PHP Syntax (Toggle Plain Text)
$aes_key = "EF77FHH7-E6G1-31y4-w2D7-G4gH8HWF20H1"; $sql = "INSERT INTO user(username, pass) VALUES ('bob', AES_ENCRYPT('password', '$aes_key' ))";
And for SELECT
PHP Syntax (Toggle Plain Text)
$aes_key = "EF77FHH7-E6G1-31y4-w2D7-G4gH8HWF20H1"; $sql = "SELECT *, AES_DECRYPT(password, '$aes_key ') AS password FROM user";
You'll have to keep the AES key as a config value or something. If you lose it you can't decrypt the data

More references here.
Last edited by jomanlk; Nov 5th, 2009 at 4:05 am. Reason: Corrected code error
1
#9 Nov 5th, 2009
•
•
•
•
I am currently building an online system, it has come to the point to think about securing peoples passwords. How ever, for admin reasons I was wondering if it was possible to decode the encoded password, I believe this is not possible with md5 but hoping there is another method?
Any help would be geat, also any other information regarding safety, thanks.
Use secure hashes to store the passwords. Add a long salt before hashing, and hash that password and salt together 100,000 times or so. Make sure you use quite a bit of memory in the process.
www.fijiwebdesign.com - web design and development and fun
Cpanel Email - Let users Register email accounts on your website upon registration
Ajax Chat - Fully browser based chat!
Cpanel Email - Let users Register email accounts on your website upon registration
Ajax Chat - Fully browser based chat!
![]() |
Similar Threads
- Qestion on Encoding and Decoding. (Python)
- Slow computer + about:blank homepage (Viruses, Spyware and other Nasties)
- Encoding/Decoding (C)
- homepage hijack "Search for..." about:blank in address (Viruses, Spyware and other Nasties)
- Trojan Problem (Viruses, Spyware and other Nasties)
- Hijacked Repeatedly "about:blank" - Please Help (Viruses, Spyware and other Nasties)
- Need review of HJT log (Viruses, Spyware and other Nasties)
- Browser Hijack (about:blank) (Viruses, Spyware and other Nasties)
- my HJT log, 2 of them for 2 comp (Viruses, Spyware and other Nasties)
Other Threads in the PHP Forum
- Previous Thread: To restrict users to choose date from date picker only
- Next Thread: Messaging System
| Thread Tools | Search this Thread |
.htaccess ajax apache api array beginner binary broken buttons cakephp checkbox class cms code cron curl database date directory display download dynamic ebooks echo email error file files folder form forms function functions google href htaccess html image include insert integration ip java javascript joomla limit link login loop mail mediawiki menu mlm mod_rewrite multiple mysql number oop paypal pdf php phpincludeissue phpmyadmin problem query radio random recursion regex remote script search server sessions sms soap source sp space speed sql subdomain syntax system table tag tutorial update upload url validation validator variable vbulletin video web websphere white xml youtube






