| | |
Password encoding/decoding
Please support our PHP advertiser: PostgreSQL or MySQL? Compare and contrast the two most popular open source databases
![]() |
•
•
Join Date: Jul 2007
Posts: 23
Reputation:
Solved Threads: 3
I am currently building an online system, it has come to the point to think about securing peoples passwords. How ever, for admin reasons I was wondering if it was possible to decode the encoded password, I believe this is not possible with md5 but hoping there is another method?
Any help would be geat, also any other information regarding safety, thanks.
Any help would be geat, also any other information regarding safety, thanks.
Here is a good PHP5 class that uses the mcrypt library for two way encryption.
php Syntax (Toggle Plain Text)
<?php class Encryption { static $cypher = 'blowfish'; static $mode = 'cfb'; static $key = '1a2s3d4f5g6h'; public function encrypt($plaintext) { $td = mcrypt_module_open(self::$cypher, '', self::$mode, ''); $iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), MCRYPT_RAND); mcrypt_generic_init($td, self::$key, $iv); $crypttext = mcrypt_generic($td, $plaintext); mcrypt_generic_deinit($td); return $iv.$crypttext; } public function decrypt($crypttext) { $plaintext = ""; $td = mcrypt_module_open(self::$cypher, '', self::$mode, ''); $ivsize = mcrypt_enc_get_iv_size($td); $iv = substr($crypttext, 0, $ivsize); $crypttext = substr($crypttext, $ivsize); if ($iv) { mcrypt_generic_init($td, self::$key, $iv); $plaintext = mdecrypt_generic($td, $crypttext); } return $plaintext; } } // Encrypt text $encrypted_text = Encryption::encrypt('this text is unencrypted'); // Decrypt text $decrypted_text = Encryption::decrypt($encrypted_text); ?>
Last edited by stymiee; Oct 15th, 2007 at 11:48 am.
John Conde
Brainyminds | Merchant Account Services | I Love Code
IT'S HERE: Merchant Accounts 101 Everything you need to know about merchant accounts!
Brainyminds | Merchant Account Services | I Love Code
IT'S HERE: Merchant Accounts 101 Everything you need to know about merchant accounts!
It can be changed to work with PHP 4. You just need to change the PHP 5 features to 4:
php Syntax (Toggle Plain Text)
<?php class Encryption { var $cypher = 'blowfish'; var $mode = 'cfb'; var $key = '1a2s3d4f5g6h'; function Encryption() { // do nothing } function encrypt($plaintext) { $td = mcrypt_module_open($this->cypher, '', $this->mode, ''); $iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), MCRYPT_RAND); mcrypt_generic_init($td, $this->key, $iv); $crypttext = mcrypt_generic($td, $plaintext); mcrypt_generic_deinit($td); return $iv.$crypttext; } function decrypt($crypttext) { $plaintext = ""; $td = mcrypt_module_open($this->cypher, '', $this->mode, ''); $ivsize = mcrypt_enc_get_iv_size($td); $iv = substr($crypttext, 0, $ivsize); $crypttext = substr($crypttext, $ivsize); if ($iv) { mcrypt_generic_init($td, $this->key, $iv); $plaintext = mdecrypt_generic($td, $crypttext); } return $plaintext; } } ?>
John Conde
Brainyminds | Merchant Account Services | I Love Code
IT'S HERE: Merchant Accounts 101 Everything you need to know about merchant accounts!
Brainyminds | Merchant Account Services | I Love Code
IT'S HERE: Merchant Accounts 101 Everything you need to know about merchant accounts!
•
•
Join Date: Oct 2009
Posts: 102
Reputation:
Solved Threads: 18
0
#6 Nov 5th, 2009
You can do it at the database level as well if you want.
For INSERT
And for SELECT
You'll have to keep the AES key as a config value or something. If you lose it you can't decrypt the data
More references here.
For INSERT
PHP Syntax (Toggle Plain Text)
$aes_key = "EF77FHH7-E6G1-31y4-w2D7-G4gH8HWF20H1"; $sql = "INSERT INTO user(username, pass) VALUES ('bob', AES_ENCRYPT('password', '$aes_key' ))";
And for SELECT
PHP Syntax (Toggle Plain Text)
$aes_key = "EF77FHH7-E6G1-31y4-w2D7-G4gH8HWF20H1"; $sql = "SELECT *, AES_DECRYPT(password, '$aes_key ') AS password FROM user";
You'll have to keep the AES key as a config value or something. If you lose it you can't decrypt the data

More references here.
Last edited by jomanlk; Nov 5th, 2009 at 4:05 am. Reason: Corrected code error
1
#9 Nov 5th, 2009
•
•
•
•
I am currently building an online system, it has come to the point to think about securing peoples passwords. How ever, for admin reasons I was wondering if it was possible to decode the encoded password, I believe this is not possible with md5 but hoping there is another method?
Any help would be geat, also any other information regarding safety, thanks.
Use secure hashes to store the passwords. Add a long salt before hashing, and hash that password and salt together 100,000 times or so. Make sure you use quite a bit of memory in the process.
www.fijiwebdesign.com - web design and development and fun
Cpanel Email - Let users Register email accounts on your website upon registration
Ajax Chat - Fully browser based chat!
Cpanel Email - Let users Register email accounts on your website upon registration
Ajax Chat - Fully browser based chat!
![]() |
Similar Threads
- Qestion on Encoding and Decoding. (Python)
- Slow computer + about:blank homepage (Viruses, Spyware and other Nasties)
- Encoding/Decoding (C)
- homepage hijack "Search for..." about:blank in address (Viruses, Spyware and other Nasties)
- Trojan Problem (Viruses, Spyware and other Nasties)
- Hijacked Repeatedly "about:blank" - Please Help (Viruses, Spyware and other Nasties)
- Need review of HJT log (Viruses, Spyware and other Nasties)
- Browser Hijack (about:blank) (Viruses, Spyware and other Nasties)
- my HJT log, 2 of them for 2 comp (Viruses, Spyware and other Nasties)
Other Threads in the PHP Forum
- Previous Thread: To restrict users to choose date from date picker only
- Next Thread: Messaging System
Views: 5172 | Replies: 18
| Thread Tools | Search this Thread |
Tag cloud for PHP
.htaccess access ajax apache api array beginner binary broken cakephp checkbox class cms code cron curl customizableitems database date directory display download dynamic echo email error file files folder form format forms forum function functions google headmethod href htaccess html image include insert integration ip java javascript joomla jquery limit link login loop mail malfunctioning menu methods mlm mod_rewrite multiple mysql oop parse paypal pdf php problem query radio random recursion regex remote script search select server sessions sms soap source space speed sql structure syntax system table tutorial update updates upload url validation validator variable video web xml youtube






