| | |
Password encoding/decoding
Please support our PHP advertiser: PostgreSQL or MySQL? Compare and contrast the two most popular open source databases
![]() |
•
•
Join Date: Jul 2007
Posts: 23
Reputation:
Solved Threads: 3
I am currently building an online system, it has come to the point to think about securing peoples passwords. How ever, for admin reasons I was wondering if it was possible to decode the encoded password, I believe this is not possible with md5 but hoping there is another method?
Any help would be geat, also any other information regarding safety, thanks.
Any help would be geat, also any other information regarding safety, thanks.
Here is a good PHP5 class that uses the mcrypt library for two way encryption.
php Syntax (Toggle Plain Text)
<?php class Encryption { static $cypher = 'blowfish'; static $mode = 'cfb'; static $key = '1a2s3d4f5g6h'; public function encrypt($plaintext) { $td = mcrypt_module_open(self::$cypher, '', self::$mode, ''); $iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), MCRYPT_RAND); mcrypt_generic_init($td, self::$key, $iv); $crypttext = mcrypt_generic($td, $plaintext); mcrypt_generic_deinit($td); return $iv.$crypttext; } public function decrypt($crypttext) { $plaintext = ""; $td = mcrypt_module_open(self::$cypher, '', self::$mode, ''); $ivsize = mcrypt_enc_get_iv_size($td); $iv = substr($crypttext, 0, $ivsize); $crypttext = substr($crypttext, $ivsize); if ($iv) { mcrypt_generic_init($td, self::$key, $iv); $plaintext = mdecrypt_generic($td, $crypttext); } return $plaintext; } } // Encrypt text $encrypted_text = Encryption::encrypt('this text is unencrypted'); // Decrypt text $decrypted_text = Encryption::decrypt($encrypted_text); ?>
Last edited by stymiee; Oct 15th, 2007 at 11:48 am.
John Conde
Brainyminds | Merchant Account Services | I Love Code
IT'S HERE: Merchant Accounts 101 Everything you need to know about merchant accounts!
Brainyminds | Merchant Account Services | I Love Code
IT'S HERE: Merchant Accounts 101 Everything you need to know about merchant accounts!
It can be changed to work with PHP 4. You just need to change the PHP 5 features to 4:
php Syntax (Toggle Plain Text)
<?php class Encryption { var $cypher = 'blowfish'; var $mode = 'cfb'; var $key = '1a2s3d4f5g6h'; function Encryption() { // do nothing } function encrypt($plaintext) { $td = mcrypt_module_open($this->cypher, '', $this->mode, ''); $iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), MCRYPT_RAND); mcrypt_generic_init($td, $this->key, $iv); $crypttext = mcrypt_generic($td, $plaintext); mcrypt_generic_deinit($td); return $iv.$crypttext; } function decrypt($crypttext) { $plaintext = ""; $td = mcrypt_module_open($this->cypher, '', $this->mode, ''); $ivsize = mcrypt_enc_get_iv_size($td); $iv = substr($crypttext, 0, $ivsize); $crypttext = substr($crypttext, $ivsize); if ($iv) { mcrypt_generic_init($td, $this->key, $iv); $plaintext = mdecrypt_generic($td, $crypttext); } return $plaintext; } } ?>
John Conde
Brainyminds | Merchant Account Services | I Love Code
IT'S HERE: Merchant Accounts 101 Everything you need to know about merchant accounts!
Brainyminds | Merchant Account Services | I Love Code
IT'S HERE: Merchant Accounts 101 Everything you need to know about merchant accounts!
•
•
Join Date: Oct 2009
Posts: 99
Reputation:
Solved Threads: 18
0
#6 17 Days Ago
You can do it at the database level as well if you want.
For INSERT
And for SELECT
You'll have to keep the AES key as a config value or something. If you lose it you can't decrypt the data
More references here.
For INSERT
PHP Syntax (Toggle Plain Text)
$aes_key = "EF77FHH7-E6G1-31y4-w2D7-G4gH8HWF20H1"; $sql = "INSERT INTO user(username, pass) VALUES ('bob', AES_ENCRYPT('password', '$aes_key' ))";
And for SELECT
PHP Syntax (Toggle Plain Text)
$aes_key = "EF77FHH7-E6G1-31y4-w2D7-G4gH8HWF20H1"; $sql = "SELECT *, AES_DECRYPT(password, '$aes_key ') AS password FROM user";
You'll have to keep the AES key as a config value or something. If you lose it you can't decrypt the data

More references here.
Last edited by jomanlk; 17 Days Ago at 4:05 am. Reason: Corrected code error
1
#9 17 Days Ago
•
•
•
•
I am currently building an online system, it has come to the point to think about securing peoples passwords. How ever, for admin reasons I was wondering if it was possible to decode the encoded password, I believe this is not possible with md5 but hoping there is another method?
Any help would be geat, also any other information regarding safety, thanks.
Use secure hashes to store the passwords. Add a long salt before hashing, and hash that password and salt together 100,000 times or so. Make sure you use quite a bit of memory in the process.
www.fijiwebdesign.com - web design and development and fun
Cpanel Email - Let users Register email accounts on your website upon registration
Ajax Chat - Fully browser based chat!
Cpanel Email - Let users Register email accounts on your website upon registration
Ajax Chat - Fully browser based chat!
![]() |
Similar Threads
- Qestion on Encoding and Decoding. (Python)
- Slow computer + about:blank homepage (Viruses, Spyware and other Nasties)
- Encoding/Decoding (C)
- homepage hijack "Search for..." about:blank in address (Viruses, Spyware and other Nasties)
- Trojan Problem (Viruses, Spyware and other Nasties)
- Hijacked Repeatedly "about:blank" - Please Help (Viruses, Spyware and other Nasties)
- Need review of HJT log (Viruses, Spyware and other Nasties)
- Browser Hijack (about:blank) (Viruses, Spyware and other Nasties)
- my HJT log, 2 of them for 2 comp (Viruses, Spyware and other Nasties)
Other Threads in the PHP Forum
- Previous Thread: To restrict users to choose date from date picker only
- Next Thread: Messaging System
| Thread Tools | Search this Thread |
advanced alerts apache api archive array autosuggest beginner binary broken cakephp checkbox class clients cms code cron curl database date display dynamic echo email emptydisplayvalue eregi error execute explodefunction file files folder form forms function functions google hack href htaccess html if...loop image include insert ip javasciptvalidation javascript joomla keywords library limit link list login mail matching menu mlm multiple mysql object oop password paypal pdf php phpincludeissue query radio random recursive remote script search searchbox seo server sessions shot smarty source space speed sql syntax system table tutorial update upload url validator variable vbulletin video web webdesign website youtube






