1

Using a form i get the information from the user and i sent it to the DB:

if (isset($_POST['email']) && $_POST['email']!='' && isset($_POST['password']) && $_POST['password']!='' && isset($_POST['nombre']) && $_POST['nombre']!='' && isset($_POST['apellido']) && $_POST['apellido']!='' && isset($_POST['cedula']) && $_POST['cedula']!='') {
    $sql="insert into usuario values('','$_POST[email]','".md5($_POST['password'])."','$_POST[nombre]','$_POST[apellido]','$_POST[cedula]','usuario')";
    mysqli_query($link,$sql);
    if (mysql_error()) {?>
        <script> alert("Error en el registro del usuario. Intente de nuevo.");</script> <?php
    }
    else{
        //sin error?>
        <script> alert("Usuario registrado exitosamente."); </script> <?php 
    }
}
else {
    //no se reciben los datos?>
    <script> alert("Debe rellenar todos los datos."); </script> <?php
}

After the creation of the user the user logins with another form and we get the information that we validate with this code:

<?php
session_start();
include "link.php";
if (isset($_POST['val'])) {
{
    switch ($_POST['val']) {
        case 1 ://autentificacion de usuario
            if (isset($_POST['email']) && $_POST['email']!='' &&          isset($_POST['password']) && $_POST['password']!='') {
                //llegaron los datos
                $sql="select * from usuario where email='$_POST[email]'";
                $query= mysqli_query($link,$sql);
                $num= mysqli_num_rows($query);
                if ($num==0) {?>
                    <script> alert("No existe el usuario")</script><?php
                }
                else{
                    //se encontro el registro
                    $row= mysqli_fetch_array ($query);
                    if ($row['password'] != md5($_POST['password'])) {
                        //no coincide contrasenia?>
                        <script> alert("contrasenia incorrecta");</script><? php
                    }
                    else{
                        //autentificacion
                        $_SESSION['id_usuario']= $row['id_usuario'];
                        $_SESSION['nombre']= $row['nombre'];
                        $_SESSION['apellido']= $row['apellido'];
                        $_SESSION['cedula']= $row['cedula'];
                        $_SESSION['tipo']= $row['tipo'];
                    }
                }
            }
            else {?>
                <script> alert("Debe rellenar todos los datos");</script><?php
            }`

But after some test it always appears to be an incorrect password. this code is for an assignment so md5 functions is a must. Any ideas?

Cookie Ninja
  • 1,156
  • 15
  • 29
Andres Payema
  • 29
  • 3
  • 4
    Do *not* use MD5 for password hashing! It is not safe or secure. – John Conde Aug 10 '16 at 23:08
  • I know. But right now we are using this function for an assignment. – Andres Payema Aug 10 '16 at 23:10
  • Before the line containing `if ($row['password'] != md5($_POST['password'])) {`, put an `echo($row['password'] . ', ' . $_POST['password'] . ', ' md5($_POST['password']));` and update your question with this result. – pah Aug 10 '16 at 23:43
  • i got from the echo this results 8, 2459, 8bdb5058376143fa358981954e7626b8 in the same order – Andres Payema Aug 11 '16 at 00:16
  • 1
    after looking up at the DB at find the problem it was the value stored. Ty for the help pah – Andres Payema Aug 11 '16 at 00:21
  • What is the original value before md5 and what is the value after md5? Also what is the value stored in the DB. Please let us know. – Robert Aug 11 '16 at 00:24
  • 2
    MD5, just hashing, is not secure. Iterate over an HMAC with a random salt for about a 100ms duration and save the salt with the hash. Use functions such as password_hash, PBKDF2, Bcrypt and similar functions. The point is to make the attacker spend a lot of time finding passwords by brute force. Consider that it is your users who are at risk from poor password handling, they expect and deserve good security. – zaph Aug 11 '16 at 01:44
  • 2
    See [How to securely hash passwords, The Theory](http://security.stackexchange.com/questions/211/how-to-securely-hash-passwords/31846#31846) on Security Stackexchange. See OWASP (Open Web Application Security Project) [Password Storage Cheat Sheet](https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet#Leverage_an_adaptive_one-way_function). See [Modern, Secure, Salted Password Hashing Made Simple](https://paragonie.com/blog/2016/02/how-safely-store-password-in-2016#legacy-hashes) – zaph Aug 11 '16 at 01:44

0 Answers0