Reply to thread

Message

<blockquote data-quote="MayoMayn" data-source="post: 390525" data-attributes="member: 71840">Sorry man, but you should find a new CMS, whoever made that, is a bunch of noobs who doesn't care about xss or sqli's. For the record, I would recommend using PDO. I can paste some code ina few minutes on how mine works.[doublepost=1480473861,1480473751][/doublepost]Totally wrong. Hashing passwords with sha1 that's already hashed with md5 is stupid lmao.[doublepost=1480474206][/doublepost]Here's how I have done it in my CMS:For hashing the password's when users register, I've done something similar to yours:[PHP]final public function hashed($password) {&nbsp; &nbsp; &nbsp; &nbsp; return password_hash($password, PASSWORD_DEFAULT);&nbsp; &nbsp; }[/PHP]And for validation passwords when user logs in, I've done this:[PHP]final public function passValidation($username, $password) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; global $db, $core;&nbsp; &nbsp; &nbsp; &nbsp; $conn = $db-&gt;PDO();&nbsp; &nbsp; &nbsp; &nbsp; try {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt = $conn-&gt;pdo-&gt;prepare('SELECT `password` FROM `users` WHERE `username` = :u LIMIT 1');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt-&gt;bindParam(':u', $username, $db-&gt;PARAM_STR);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt-&gt;execute();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if(password_verify($password, $stmt-&gt;fetchColumn())) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return true;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return false;&nbsp; &nbsp; &nbsp; &nbsp; } catch(PDOException $e) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; die($e-&gt;getMessage());&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; $conn = null;&nbsp; &nbsp; }[/PHP]Oops, please bear in mind, that I'm using class-oriented PDO, and not mysql or mysqli.Just use:[PHP]if(password_verify($password, $stmt-&gt;fetchColumn())) {&nbsp; &nbsp; &nbsp; return true;}[/PHP]and switch out [PHP]$stmt-&gt;fetchColumn()[/PHP] with whatever users stored password in db is.Anyway I'm just wondering, if I am really the only one with a hotel, which is not a complete shitload of deprecated coding?[doublepost=1480474827][/doublepost]Anyway, if you want to convert md5 into sha1, devbest is probably not the best way to ask a question. A simple Google search gave you the answer:<a href="https://stackoverflow.com/questions/1381448/how-do-i-convert-password-hashing-from-md5-to-sha" target="_blank">https://stackoverflow.com/questions/1381448/how-do-i-convert-password-hashing-from-md5-to-sha</a></blockquote>

[QUOTE="MayoMayn, post: 390525, member: 71840"] Sorry man, but you should find a new CMS, whoever made that, is a bunch of noobs who doesn't care about xss or sqli's. For the record, I would recommend using PDO. I can paste some code ina few minutes on how mine works. [doublepost=1480473861,1480473751][/doublepost] Totally wrong. Hashing passwords with sha1 that's already hashed with md5 is stupid lmao. [doublepost=1480474206][/doublepost]Here's how I have done it in my CMS: For hashing the password's when users register, I've done something similar to yours: [PHP] final public function hashed($password) { return password_hash($password, PASSWORD_DEFAULT); } [/PHP] And for validation passwords when user logs in, I've done this: [PHP] final public function passValidation($username, $password) { global $db, $core; $conn = $db->PDO(); try { $stmt = $conn->pdo->prepare('SELECT `password` FROM `users` WHERE `username` = :u LIMIT 1'); $stmt->bindParam(':u', $username, $db->PARAM_STR); $stmt->execute(); if(password_verify($password, $stmt->fetchColumn())) { return true; } return false; } catch(PDOException $e) { die($e->getMessage()); } $conn = null; } [/PHP] Oops, please bear in mind, that I'm using class-oriented PDO, and not mysql or mysqli. Just use: [PHP] if(password_verify($password, $stmt->fetchColumn())) { return true; } [/PHP] and switch out [PHP]$stmt->fetchColumn()[/PHP] with whatever users stored password in db is. Anyway I'm just wondering, if I am really the only one with a hotel, which is not a complete shitload of deprecated coding? [doublepost=1480474827][/doublepost]Anyway, if you want to convert md5 into sha1, devbest is probably not the best way to ask a question. A simple Google search gave you the answer: [URL]https://stackoverflow.com/questions/1381448/how-do-i-convert-password-hashing-from-md5-to-sha[/URL] [/QUOTE]

Verification

Reply to thread

Connect with us

Newest members