reverse PASSWORD()

[michelleqw]

Dear users,

In my table I place a password encrypted with the function PASSWORD(). What is the function to get the original password?

Michelle.

 

[sleipnir214]

PHP doesn't have a function named password(). So this question is specific to the unspecified database you are using.

Typically, though, password-encryption functions do not encrypt values, they hash them. Hashes, by design, are one-way.


Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[MJB3K]

you could always try making your own functions to crypt and decrypt passwords.


Regards,

Martin

Gaming Help And Info:

http://gaming.webrevolt.biz

 

[robbieguy2003]

I normally hash with MD5, its basic but does the job.

<?

$pass = "abcd";

$md5pass = md5($pass);

echo "before MD5:  $pass<BR><BR>";
echo "After MD5:   $md5pass<BR><BR>";

?>

If you have a login system (or a members area) hash the chosen password on signup and send the hashed value to the database. Then when a user logs in and enters there password, hash it again and send it to the database to check.

You've now got MD5 passwords. For use with Mysql the databases password field should be varchar for type and 32 characters long.

HTH

Triangular sandwiches taste better than square ones.

Rob

 

[MJB3K]

yea, i use that for my login system!

Regards,

Martin

Gaming Help And Info:

http://gaming.webrevolt.biz

 

[robbieguy2003]

It works really well. Not too complex and is a little better than sending the password in cleartext on a http (unsecured) connection.

Triangular sandwiches taste better than square ones.

Rob

 

[MJB3K]

only problem: you cant resend their password to them via email...

wont be able 2 read it...

solution:

update the database to a random pword e.g. afkf92s, email them that, and they change it

good luck


Regards,

Martin

Gaming Help And Info:

http://gaming.webrevolt.biz

 

[robbieguy2003]

Thats what i do to (enter username here and email address), it sets a flag in a database then gets picked up by an every 5 minute job in cron and they get there mail with new password.

Triangular sandwiches taste better than square ones.

Rob

 

[Olavxxx]

I think I would flag in the table, "reset passwd" with a timestamp.

Then I would email the user an "reset passwd" link, with a:

http://www.domain.tld/path/to/script.php?r_id=123

where 123 would be the user_id.

Then the script would check if datediff() on the "reset passwd) vs. NOW() was > 5. If not, set passwd to RanString() (random), else: tell user to request password reset again.

almost the same as samples above, but I think it should not reset passwd, untill the user has clicked the link in his browser.

You could also add some fields: passwd hint, etc. for further verification, but I doubt it's really needed.