0

When the user signs up the php 5.5 password hashing api is used where the salt is part of the hashed password and does no have to be stored separately. When a user logs in you compare the password they entered ($password) to the hashed password stored in the database ($hash). Therefore you compare them using:

<?php
if (password_verify($password, $hash)) {
// Success!
}
else {
// Invalid credentials
}

The problem with this is that you can't hash the password and then see if both the email and password exist in the database using code like:

    if ($stmt = $mysqli->prepare("SELECT id, username, password, salt 
    FROM members
   WHERE email = ?
    LIMIT 1")) {
    $stmt->bind_param('s', $email);  // Bind "$email" to parameter.
    $stmt->execute();    // Execute the prepared query.
    $stmt->store_result();

    // get variables from result.
    $stmt->bind_result($user_id, $username, $db_password, $salt);
    $stmt->fetch();

    // hash the password with the unique salt.
    $password = hash('sha512', $password . $salt);
    if ($stmt->num_rows == 1) {

I was considering fetching the password for a set email and setting it the value of $hash and then running the first piece of code, but I believe that it would be open to hacking via sel injection. So how would I check if a email and password are correct in order to validate a login? Thanks :)

dominicansell
  • 85
  • 2
  • 10
  • Just do it in 2 steps. First check if there is a record with the given email, if so proceed to step 2 and validate the password with password_verify... ? – DarkBee Dec 14 '14 at 17:10
  • So search for the email entered and return the password associated with that email, then check if the password is the same as the one entered using the password_verify function. If I am using the "where email is equal to email entered", can't someone enter a command instead of an email? – dominicansell Dec 14 '14 at 17:15
  • Well you are using prepared statements, which is a good thing, so you should be safe for SQL injections. – DarkBee Dec 14 '14 at 17:17
  • So as long as I use prepared statements within the PHP, I should be relatively safe from sql injections? Thanks for your help. – dominicansell Dec 14 '14 at 17:24
  • Yes indeed, in this [topic](http://stackoverflow.com/questions/134099/are-pdo-prepared-statements-sufficient-to-prevent-sql-injection) you can read more about it – DarkBee Dec 14 '14 at 17:29

0 Answers0