Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations gkittelson on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
Crypt in PHP w/ htaccess
- Thread starter gagz
- Start date
sleipnir214
Programmer
If your intent is to write a PHP script which will allow you to manage Apache permissions, I recommend that, if available, you invoke the htpasswd application externally.
Apache's authentication system uses either the system's crypt() function (if available) or a modified version of MD5.
Want the best answers? Ask the best questions!
TANSTAAFL!!
Apache's authentication system uses either the system's crypt() function (if available) or a modified version of MD5.
Want the best answers? Ask the best questions!
TANSTAAFL!!
- Thread starter
- #3
ok, i think that will be best if i can get it too work. I was running htpasswd on the command line, with -b and -c, passing the username and password. Looks like the pw file is created correctly, and my .htaccess file looks fine, but it doesn't like any passwords. Any idea?
sleipnir214
Programmer
At this point, we have gone from a PHP question to an Apache question.
Want the best answers? Ask the best questions!
TANSTAAFL!!
Want the best answers? Ask the best questions!
TANSTAAFL!!
- Thread starter
- #6
ericbrunson
Technical User
Sure it is. Unix crypt() and md5() are both one way hash functions. In fact, many linux distributions use md5 checksums for their system password hashes, it allows you to use longer passwords securely.
Hmm.. I know I've had discussions about this, maybe 1 year ago. I wanted to use md5, but ended up using crypt().
the md5 is one-way and therefore the passwords can not be decrypted.
I know this might not be a problem, but I dont remember specifically why crypt() was better.
I will try to look it up.
the md5 is one-way and therefore the passwords can not be decrypted.
I know this might not be a problem, but I dont remember specifically why crypt() was better.
I will try to look it up.
ericbrunson
Technical User
unix crypt() is one-way and cannot be decrypted. It as a misnomer because it is not an encryption, but a hashing algorithm.
The method to authenticate is to take the password the user offers, crypt or md5 it and compare it to the stored hash.
Whoever told you not to use md5 probably didn't know what they were talking about. md5 is actually better than crypt because the probability of a hash collision (two passwords having the same hash value) is orders of magnitude smaller.
The method to authenticate is to take the password the user offers, crypt or md5 it and compare it to the stored hash.
Whoever told you not to use md5 probably didn't know what they were talking about. md5 is actually better than crypt because the probability of a hash collision (two passwords having the same hash value) is orders of magnitude smaller.
- Status