last day (15 days later) » 

1:59 AM
-3
Q: How to hash existing raw passwords in database?

Maybe AngeI have a login page for admins except I've had it for 1 year like this with raw passwords in the PhPMyAdmin database. Since I don't use a registration form, I can't hash passwords. How can I encrypt them directly on PhPMyAdmin? I tried a few things but nothing worked! I don't know how to go abou...

 
phpmyadmin is just a GUI tool for mysql / mariadb databases. There is no such thing as phpmyadmin databases or doing something directly in phpmyadmin (apart from clicking). You use php to connect to mysql or perform some database operations there. Just like phpmyadmin does in its backend.
You can always hash passwords. How are passwords created if the users do not sign up?
 
Just FYI, encryption and hashing are not the same thing...you can't use those terms interchangeably. You will want to hash the passwords, not encrypt them, for it to be properly secure.
Even if you don't have a regular registation process you need at least a small PHP script (even if it's a command-line one or something) which you use to create/update users, and you would hash the password (using password_hash()) as part of that. Then the login page can use password_verify to check them at login time. I don't believe any equivalent functionality is available directly in mysql (or even via mysql admin tools such as phpmyadmin)
 
@Ombre It was me who put it by hand on phpmyadmin the passwords
@ADyson I already looked, but that's not it! I don't have a registration form, I put the passwords by hand in phpmyadmin
 
I make it, the OP is asking for such a script written for them
 
I put the passwords by hand in phpmyadmin...well you'll need to stop doing that, and make a small PHP script to handle creating and updating users, as I mentioned above. It could be a little command-line script, or you could make it part of an admin area of your site, perhaps. It doesn't really matter, the point is that you need to write it.
 
1:59 AM
FYI: You should not alter a posted password in any way or form, otherwise chances are the posted password doesn't match the hash stored inside the database
 
^^^ this is a good point. Your "validate" function is doing nothing good, and potentially is just harming your data. Please explain why you think it won't be acceptable for the password to contain slashes, or HTML characters, or spaces at the beginning or end? Why should those be removed? They are entirely valid characters to use in a password. Or did you just copy and paste this nonsense from w3fools without giving it any thought?
Warning: Your code is vulnerable to SQL Injection attacks. You should use parameterised queries and prepared statements to help prevent attackers from compromising your database by using malicious input values. bobby-tables.com gives an explanation of the risks, as well as some examples of how to write your queries safely using PHP / mysqli. Never insert unparameterised data directly into your SQL. The way your code is written now, someone could easily steal, incorrectly change, or even delete your data.
phpdelusions.net/mysqli also contains good examples of writing safe SQL using mysqli. See also the mysqli documentation and this: How can I prevent SQL injection in PHP? . Parameterising your queries will also greatly reduce the risk of accidental syntax errors as a result of un-escaped or incorrectly quoted input values. If you learnt your current technique from a tutorial or book, please don't use that resource again.
 
My mysql server 8.0.31-0ubuntu0.20.04.1 supports md5() and sha1() functions, so you could write a simple update query if your password column can take the resulting strings. Then you just need to change your comparisons in your PHP so the program looks for the hash instead of the actual password. I think in PHP you have to use the hash("sha1",..) function for sha1 but there's a md5() function.
 
@SimonGoater It does, but those algorithms are both considered obsolete and insecure and are fairly easy to crack - no-one should be writing new code to make use of them, and any systems currently using them need to be upgraded to secure hashing algorithms as soon as is practical. So I'm not sure why you'd be mentioning those, really. Even the mysql documentation explicitly discourages their use (see the Note in the blue box).
 
@ADyson Neither md5 nor sha1 can be reverse hashed unless the password was weak. Weak passwords can be reverse hashed even if you use 'acceptable' password hashing algorithms like sha256/512, bcrypt etc. The OP currently has paintext passwords, so anything is better than that.
 
I implemented a service some 10 years ago that does exactly what you are looking for: it used any form of password that existed in the database to authorize access, hashed or not, regardless of the hash algorithm used when generation the entry by switching over the pattern of the string contained in the password column of the database table. When the entry was a plain text password the service hashed and updated the entry on the fly. That way the system was self healing, kind of. I could look for the code lines of they are of interest for you.
 
1:59 AM
@SimonGoater maybe true, but since we're starting from scratch, it would make sense to at least use an up to date method, which they could easily do. mysql has sha2, if nothing else.
 
@ADyson Who said anything about starting from scratch? This wasn't a question about best practice for storing hashed passwords. The OP appears to me to be looking for a quick and easy way of making their passwords more secure. There are numerous issues as others have pointed out, but starting again from scratch and following all the latest guidelines isn't always realistic. IMHO, a significant improvement in their password security could be met simply by ensuring the passwords are strong, replacing those that aren't, and hashing with a secret salt, even with md5 would be a big improvement.
 
Ok, so it sounds like you are creating users manually using phpMyAdmin so all you need is a little PHP script that you can run from the PHP CLI (command line/Terminal) that will hash a string for you. so here it is if ( $argc < 2) { echo 'ERROR >>> call me using one parameter: The string you want to HASH'; } else { echo password_hash($argv[1], PASSWORD_DEFAULT); }
Then copy/paste the output into your password column
 
@ADyson Maybe the code is vulnerable to SQL attacks, however, another security is behind, admin must have their Google account logged in from the web browser. If this rule is not respected, there will be denied access, even logged in to the administration panels.
 
PS: Do please get rid of that validate function it is complete nonsense. A nasty hangover from the very early days of the web
 
@arkascha I think I should need login script temporarily which allows me to create an account from this login form.
 
1:59 AM
@MaybeAnge you should still put all possible protections in place including sql injection protection, regardless of other security measures. And it will increase reliability too, as I mentioned above. If you're not doing that on your login page, then I would assume you're not doing it elsewhere in the application either
 
@ADyson How to do it? I'm not good at all basic in php
 
How to do what, exactly? We have told you many things in this thread. If you are asking about SQL injection, there are several links in my earlier comments explaining what to do, and giving lots of examples.
 

last day (15 days later) »