Member Avatar for Anubhav_1

Hello, i just coded for login script now i want to add "sha1" to my code due to security reason but it's showing an invalid login error i don't know the reason but when i use this withouht "sha1" it's working fine but i want to secure password into database please hwlp what's wrong i'm doing..

here is my code for login.php:

<?php
include("config.php");
session_start();
if($_SERVER["REQUEST_METHOD"] == "POST")
{

// username and password sent from Form
$myusername=addslashes($_POST['username']);
$mypassword=addslashes($_POST['password']);

$sql="SELECT * FROM admin WHERE username='$myusername' AND passcode='.sha1[$mypassword]' ";
$result=mysql_query($sql);
$row=mysql_fetch_array($result);
$active=$row['active'];
$count=mysql_num_rows($result);


// If result matched $myusername and $mypassword, table row must be 1 row
if($count==1)
{
$_SESSION["myusername"];
$_SESSION['login_user']=$myusername;

header("location: welcome.php");
}
else
{
echo "Your Login Name or Password is invalid";
}
}
?> <form action="" method="post"> <label>UserName :</label> <input type="text" name="username"/><br /> <label>Password :</label> <input type="password" name="password"/><br/> <input type="submit" value=" Submit "/><br /> </form>

And here is my code for insert.php:

<?php
$con=mysqli_connect("localhost","root","Bhawanku","members");
// Check connection
if (mysqli_connect_errno())
{
    echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
$hash_key=sha1($_POST['password']);
$sql="INSERT INTO admin
VALUES
('', '$_POST[username]','$hash_key')";

if (!mysqli_query($con,$sql))
{
    die('Error: ' . mysqli_error($con));
}
echo "1 record added";

mysqli_close($con);
?>
  • 3 Contributors
  • 2 Replies
  • 234 Views
  • 15 Hours Discussion Span
  • Latest Post Latest Post by Bob Hensley

Dani AI

Generated

Quick diagnosis and what's actually breaking: the login SQL is comparing the password column to a literal string instead of to a computed hash, and the code mixes the old ext/mysql style with mysqli and uses addslashes() (which is not a safe escape). As hinted, the SHA1 expression in the query is malformed; as pointed out, stop mixing APIs — the original MySQL extension is deprecated and removed in newer PHP versions. (php.net)

Better approach (short): never store raw passwords and avoid plain SHA1 for password storage. Use PHP's password_hash() when creating the stored password and password_verify() at login; these include salt and algorithm metadata and are safer than single-round hashes like SHA1. Also use prepared statements (PDO or MySQLi) so input is never concatenated into SQL. password_hash() output can be longer than older hashes, so use something like VARCHAR(255) for the password column. (php.net)

Example flow (PDO + modern hashing):

# registration (hash on insert)
$hash = password_hash($_POST['password'], PASSWORD_DEFAULT);
$stmt = $pdo->prepare('INSERT INTO admin (username, passcode) VALUES (:u,:p)');
$stmt->execute([':u'=>$_POST['username'], ':p'=>$hash]);

# login (verify)
$stmt = $pdo->prepare('SELECT id, passcode FROM admin WHERE username = :u LIMIT 1');
$stmt->execute([':u'=>$_POST['username']]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);
if ($user && password_verify($_POST['password'], $user['passcode'])) {
    session_regenerate_id(true);
    $_SESSION['login_user'] = $user['id'];
    header('Location: welcome.php'); exit;
}

Prepared statements protect against injection and let the DB handle quoting; they should be used for every variable. If there are existing SHA1 rows, verify with SHA1 once on login and then rehash with password_hash() on success. For general guidance on prepared statements see the PHP docs. (php.net)

Troubleshooting tips: dump the computed hashes and the DB value to compare, check column length, and log the exact prepared statement parameters (not raw SQL with credentials). Replace addslashes() and deprecated functions now — standardize on PDO or MySQLi and move to password_hash() for long-term security.

Recommended Answers

All 2 Replies

Member Avatar for Szabi Zsoldos

Line 11 looks weird with the SHA1 function.

$sql="SELECT * FROM admin WHERE username='$myusername' AND passcode='.sha1[$mypassword]' ";

//should be

$sql="SELECT * FROM admin WHERE username='".mysql_real_escape_string($myusername)."' AND passcode='".sha1(mysql_real_escape_string($mypassword))."' ";
Edited by Szabi Zsoldos because: mysql_real_escape_string
Member Avatar for Bob Hensley

I'm confused on why you're using MySQLi in your insertion script, yet the original and long-since dropped, but now officially deprecated, MySQL extension. Using the original MySQL extension is incredibly inappropriate these days. You have some MySQLi usage in your project; standardize on it and take advantage of parameterized statements

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.