PHP md5 password; can't login

[albertc]

Hey,

Since this is my first post here, I'd like to say hello

I'm a complete noob in the php world, but I have to set up a database and some config files to make an experiment working.
My config file is for configuring the login and pass for my server, database and the GUI login panel.

This is the config file

//$sHost should be the MYSQL host of the database, by default localhost 
  $sHost               = "localhost"; 
   
  //$sUser should be the user of the database 
  $sUser             = "root"; 
   
  //$sPass should be the password of the database user supplied before 
  $sPass             = "root"; 
   
  //$sDatabase should be the database name where the tables should be installed in 
  $sDatabase         = "database_name"; 
   
  //$sPanelUsername should be the username you want to login to the panel 
  $sPanelUsername     = "Panel_Username"; 
   
  //$sPanelPassword should be the password you want to login to the panel 
  $sPanelPassword     = "PanelPass"; //MD5(Password)

This is the part of the index.php for the login panel

  //LOGIN 
            if (isset($_GET['login'])) { 
                if (isset($_POST["password"])) { 
                    if ((md5($_POST["password"]) == $sPanelPassword) && ($_POST["username"] == $sPanelUsername)) { 
                            $_SESSION["password"] = $sPanelPassword; 
                            $_SESSION["username"] = $sPanelUsername; 
                            //Logged in, Proceed.. 
                            header('Location: ?stats'); 
                    } 
                } 
                Print file_get_contents("inc/login.html"); 
                exit; 
            }

I did not write this myself, I got it from the net. Everything seems to work fine except the login.
I tried to change the md5 pass to a non encrypted password, but this failed misserably.

EDIT: I got no error messages.

Can someone help me out?

thx

 

[jazzc]

Welcome aboard.

Go here: http://www.md5.cz
Type the password you want, press the button, copy the long string into the last variable of the config file

$sPanelPassword = "LongString!!!";

When you log in, use the original password.

 

[albertc]

Welcome aboard.

Type the password you want, press the button, copy the long string into the last variable of the config file

When you log in, use the original password.

I already did that, it doesn't seem to respond.
when I changed the md5 to non encrypted I did this:

  //LOGIN 
            if (isset($_GET['login'])) { 
                if (isset($_POST["password"])) { 
                    if (($_POST["password"]) == $sPanelPassword) && ($_POST["username"] == $sPanelUsername)) { 
                            $_SESSION["password"] = $sPanelPassword; 
                            $_SESSION["username"] = $sPanelUsername; 
                            //Logged in, Proceed.. 
                            header('Location: ?stats'); 
                    } 
                } 
                Print file_get_contents("inc/login.html"); 
                exit; 
            }

I removed the md5 out of this string

if (($_POST["password"]) == $sPanelPassword) && ($_POST["username"] == $sPanelUsername))

Is there a possibility that if I removed the the variables in the config file and used fixed values in the index.php, it will work?

 

[dineshag]

Try printing your POST data and see if your server is getting the values correct or not. This will tell you if you are able to fetch post data or not.

 

[albertc]

Try printing your POST data and see if your server is getting the values correct or not. This will tell you if you are able to fetch post data or not.

I'm going to try this tonight.

 

[ekapek]

You neeed md posted pass to compare

if ((md5($_POST["password"]) == $sPanelPassword) && ($_POST["username"] == $sPanelUsername))

Also ou mix GET and POST - are you sure you send login to ?login url? Check contents of $_GET and $_POST

 

[mantic0re]

Md5 is not encryption, its a hash algorithm. I would guess that your database password column is setup to contain less characters than the length of the md5 string.

 

[revproxy]

Md5 is not encryption, its a hash algorithm. I would guess that your database password column is setup to contain less characters than the length of the md5 string.

Yes - this is very popular senario, check the length - you can fix it with simple query:

alter table [table] modify [column] varchar(32);

 

[flaveris]

And please - for the sake of security - don't use md5 for password hashing! ) Those hashes can be decoded in an eye blink.

 

[iBrazilian]

Just use bcrypt for more security.

 

[IMpossible]

Or just use:

md5("yourpasswordhere")