Echoing a password from mysql to webpage.

[vincelewin]

Hi all,

I am relatively new to this so please excuse my ignorance.

I am building an application available to registered users. Any one can register and provide a username and password. At the end of the registration I am echoing back to them the information they have added and also emailing it to them.

My problem is this, in mysql I have a table that holds the user information inc. passwords. I want to echo back the password but it just comes through encrypted and appears as alphnumberic characters.

This is the query I am running to insert the info

$sql = "INSERT INTO member (loginname,password,dateacccreated) VALUES('$_SESSION[username]',password('$userpass'),'$today')";
mysql_query($sql) or die(mysql_error());

How do I convert the data in member.password back to plain text so I can echo it out to a webpage/email?

 

[vincelewin]

Sorry I am trying to echo it with the line below.

<?php echo"<td class='mainaccbody'><font class='mainaccbody'>Pass:<strong>&nbsp{$acconerow['password']}</strong></font>";?>

This just give me back a long string of characters but this does not read as the passwrod entered.

Thanks

Vince

 

[mcvdmvs]

You are using the mysql function password, this function makes a hash and is therefor not reversible.A very save way of storing passwords.

When you want users to recover lost passwords, offer them a way to generate a new one instead, using there e-mailaddress. Or don't put the password hashed in mysql, but encrypt it using PHP.

mcvdmvs
&quot;It never hurts to help&quot; -- Eek the Cat

 

[vincelewin]

Thanks.

Ill take ur advice and provide an alternate method of password reset.

 

[jpadie]

A very save way of storing passwords.

I recall reading that it is contra-indicated to use mysql password as a way of encrypting content. sorry that i can't provide a link to the source (it was in the php manual tho)

the received wisdom is to use one way algorithms in php such as crypt and store the resultant hash in mysql as plain text. in the past i have used md5 hashes but i am moving away from these as encryption routines due to the websites on the net that are compiling lists of md5 hashes and their clear text equivalents.

i would recommend not using reversible encryption but going down the password reset route as suggested above