PHP MD5 Create User Form

Question

I have used a tutorial here: http://www.phpeasystep.com/phptu/26.html to create a login form for my website. I have set the uPassword field in my database to be md5 and all of the passwords in the database are encrypted with md5.

The login works perfectly, however I am slightly confused about creating a registration form.

The form requests for a user to input their desired password. I am slightly confused as to how I will then take the password that the user inputs, converting it to md5 and then inputting the md5 password into the uPassword field in the user table.

Below is the code that I have for the processresgistration.php file:

/* Database connection info*/
mysql_select_db("dbname", $con);

$encryptedpassword = md5($_POST['uPassword']);

md5($uPassword);

$sql="INSERT INTO users (uName, uPassword, uSurname, uFirstName)
VALUES
('$_POST[uName]','$encryptedpassword','$_POST[uSurname]','$_POST[uFirstName]'";

if (!mysql_query($sql,$con))
  {
  die('Error: ' . mysql_error());
  }
echo "Account created.  You can now login";

mysql_close($con)
?>

The code above is supposed to:

• Create a variable named encryptedpassword
• Use uPassword as encryptedpassword
• Convert encrypted password to MD5
• Input the MD5 password into the users table as uPassword

I'm sure that I've not used a correct variable somewhere, or I have done a simple error with my syntax; any comments/help is greatly appreciated!

Thanks, Chris M

Answer 1

You code require some validation & escaping, more like this :

<?php

/* Database connection info */
mysql_select_db("dbname", $con);

if ($_REQUEST['METHOD'] == 'POST') {
    $uName = filter_input(INPUT_POST, 'uName');
    $uPassword = filter_input(INPUT_POST, 'uPassword');
    $uSurname = filter_input(INPUT_POST, 'uSurname');
    $uFirstName = filter_input(INPUT_POST, 'uFirstName');

    // do some validation here ...

    // if everything OK, then crypte the password
    $hashedPassword = md5($uPassword);

    // and store it

    $sql = sprintf(
        'INSERT INTO users (uName, hashedPassword, uSurname, uFirstName)
         VALUES (%s, %s, %s, %s);',
            mysql_real_escape_string($uName, $con),
            mysql_real_escape_string($hashedPassword, $con),
            mysql_real_escape_string($uSurname, $con),
            mysql_real_escape_string($uFirstName, $con)
    );

    if (!mysql_query($sql,$con)) {
        die('Error: ' . mysql_error());
    }

    mysql_close($con);
    echo "Account created.  You can now login";
}

?>

Now for login

<?php

if ($_REQUEST['METHOD'] == 'POST') {
    $uName = filter_input(INPUT_POST, 'uName');
    $uPassword = filter_input(INPUT_POST, 'uPassword');
    $hashedPassword = md5($uPassword);

    $sql = sprintf(
        'SELECT * FROM users WHERE uName = "%s" AND hashedPassword = "%s" LIMIT 1',
            mysql_real_escape_string($uName, $con),
            mysql_real_escape_string($hashedPassword, $con),
        );

    // etc etc ...
}
?>

Answer 2

/* Database connection info*

You didn't properly close your comment there. Add a / at the end of the line.

Oh, and MD5 is insecure. Use SHA1 instead. Or even better, use salted SHA1.

You also need to start escaping all user input you are putting in your database using mysql_real_escape_string() or Little Bobby Tables will have lots of fun with your database.

Answer 3

/* Database connection info*/

 mysql_select_db("dbname", $con);

$encryptedpassword = md5($_POST['uPassword']);

$sql="INSERT INTO users (uName, uPassword, uSurname, uFirstName)
VALUES
('$_POST[uName]','$encryptedpassword','$_POST[uSurname]','$_POST[uFirstName]')";

if (!mysql_query($sql,$con))
  {
  die('Error: ' . mysql_error());
  }
echo "Account created.  You can now login";

mysql_close($con)
?>

The closing of bracket is the issue in query

('$_POST[uName]','$encryptedpassword','$_POST[uSurname]','$_POST[uFirstName]'";

This needs a closing ' ) '