Hi i am new to PHP,
Can anyone fix this problem to me. i am writing a code to change password where i have already encoded a password and stored in database. and in a new changepassword form i have to do two things one is to get the oldpassword , encode it and compare it with already stored password and the second one is to get NEWPASSWORD , encode it and store it in DB. ie i need to encode two times . one is for old password and another is for new password. i succesfully encode old password and checks it to DB. But i am unable to encode a NEWPASSWORD.

function encode5t($OldPassword)
		{
 		 for($i=0; $i<5;$i++)
  		  {
   		  $OldPassword=strrev(base64_encode($OldPassword)); 
  		}		
  		  return $OldPassword;
		}
	$EncOldPwd = encode5t($OldPassword);
	function encode5t($NewPassword)
		{
 		 for($i=0; $i<5;$i++)
  		  {
   		  $NewPassword=strrev(base64_encode($NewPassword)); 
  		}		
  		  return $NewPassword;
		}
	$EncNEWPwd = encode5t($OldPassword);

WHEN I RUN THIS i got the error as

Fatal error: Cannot redeclare encode5t() (previously declared in C:\wamp\www\prawin\new\locations\test\admin\Changepassword.php:9) in C:\wamp\www\prawin\new\locations\test\admin\Changepassword.php on line 25

Dani AI

Generated

Quick fixes for the immediate error and the bug in the sample:

  • The fatal error comes from declaring encode5t() twice; define it once and call it for both old and new passwords (as suggested).
  • Also fix the call at the end: you meant to encode the new password, not the old one when creating $EncNEWPwd (that copy/paste slip is why the new password never changes). was right to check for duplicate includes, too.

Security note (important):

  • The current “5× base64 + strrev” approach is reversible and not suitable for password storage; do not treat it as hashing or encryption. See PHP’s base64 docs for how it’s an encoding, and see OWASP’s guidance on proper password storage. (base64_encode() manual) (OWASP Password Storage Cheat Sheet). called this out correctly.

Recommended, practical migration plan

  • Keep a single function to detect legacy passwords and a modern path using PHP’s password_hash() / password_verify(). On change-login: if password_verify($old, $stored) succeeds update the DB with password_hash($new, PASSWORD_DEFAULT). If password_verify fails, check the legacy encoder (encode5t($old) === $stored) and, if that matches, immediately replace the stored value with password_hash($new, PASSWORD_DEFAULT). Use password_needs_rehash() to rehash when algorithm/cost changes. (password_hash() manual) (password_verify() manual) (password_needs_rehash() manual)

Implementation tips

  • Store hashes in a column sized for growth (VARCHAR(255) is common), validate/confirm the new password, use prepared statements when updating the DB, and test migrations on a staging copy first.

Recommended Answers

All 3 Replies

dont for get to base64_decode

and i think you might want to change the function name to some thing else then function encode5t for both of them


also are you includeing this file into your script more then once possibly ?

You don't have to write the function twice to call it twice, once is enough. Try something like this:

<?php
function encode5t($password)
		{
                  $ret = $password;
 		 for($i=0; $i<5;$i++)
  		  {
   		  $ret=strrev(base64_encode($ret)); 
  		}		
  		  return $ret;
		}

$EncOldPwd = encode5t($OldPassword);
$EncNEWPwd = encode5t($NewPassword);
?>
commented: useful +4

Please forgive me for replying this late, but I found this code in use on one of my client's websites.

DO NOT EVER USE THIS CODE FOR "ENCRYPTION" AND/OR "HASHING" ANYWHERE, EVER.

A) It's not encryption or hashing as it's trivially reversible
B) Longer plaintext results in longer codewords
C) Similar plaintext yields similar codewords
D) I will kill you.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.