0

can someone help me? I already read other posts like my problem. but after I tried to fix it, my md5 login still won't let me log in

<?php
session_start();
include 'config.php';
$nama = $_POST['nama'];
$password = md5($_POST['password']);

$query = "SELECT * FROM user WHERE nama = '$nama'";
$hasil = mysql_query($query);
$data = mysql_fetch_array($hasil);
// cek kesesuaian password
if ($password == $data['password'])
{
    $_SESSION['status'] = $result['status'];
    $_SESSION['nama'] = $result['nama'];
    $_SESSION['izin'] = $result['nama'];
    print "<script>window.location='status.php'</script>";
}
else
{
    print "<script>window.alert('Pastikan Username dan Password Anda Benar')</script>";
    print "<script>window.location='index.php'</script>";
}

?>
David Jones
  • 4,275
  • 6
  • 27
  • 51
Henrikus Anthony
  • 154
  • 2
  • 4
  • 12
  • Have you tried using echo to look at the values. What does: `echo $data['password'] . " == " . $password; ` look like? – Patchesoft Oct 09 '15 at 16:05
  • 1
    Also make sure the password in the db is md5*ed*. Oh, an please do not use md5 for password storage, check this: http://stackoverflow.com/questions/1581610/how-can-i-store-my-users-passwords-safely – mTorres Oct 09 '15 at 16:08
  • @Patchesoft it shows md5 code from my password – Henrikus Anthony Oct 09 '15 at 16:09
  • @Patchesoft d41d8cd98f00b204e980 == dc468c70fb574ebd07287b38d0d0676d – Henrikus Anthony Oct 09 '15 at 16:11
  • @mTorres what is md5*ed*?? this just for my school task. btw – Henrikus Anthony Oct 09 '15 at 16:14
  • I don't know if you have to tell your teacher this or you teacher will take points off but: this is easily hacked via sql injection; mysql* functions are deprecated-- don't use them; md5 should not be used for passwords as @mTorres pointed out; you're not checking for sql error cases. – Digital Chris Oct 09 '15 at 16:17
  • @DigitalChris okay then, I'll use other password encryption apart from this project. thanks for the information. – Henrikus Anthony Oct 09 '15 at 16:24
  • Why to echo – Pratik Joshi Oct 09 '15 at 16:31
  • 1
    @HenrikusAnthony, md5*ed*, was my clumsy way to say that you have to apply the md5 function to the string before saving it to the password field in the db, I'm guessing you are doing it, aren't you? – mTorres Oct 09 '15 at 16:38
  • The main purpose of hashing is to avoid sending plaintext passwords over the wire - you should be applying your hashing algorithm to the data in `$_POST['password']` on the client side via javascript... – Gershom Maes Oct 09 '15 at 17:49
  • @GershomMaes What?? This is completely incorrect. http://php.net/manual/en/faq.passwords.php – Digital Chris Oct 09 '15 at 20:03
  • `Without hashing, any passwords that are stored in your application's database can be stolen if the database is compromised, and then immediately used to compromise not only your application, but also the accounts of your users on other services` - it's saying almost exactly what I'm saying. The idea is that with hashing it is safe to have user's passwords discovered, because they will still not be known. A positive change to this app would be to perform the hashing on the client side. That way not only can the database afford to be compromised, but middleman attacks will be less damaging. – Gershom Maes Oct 11 '15 at 16:54

0 Answers0