Cannot get correct MD5 hash with MySQL

Dev Shed Forums Sponsor:

November 4th, 2012, 07:28 PM

Brute

Registered User

Join Date: Nov 2012

Posts: 10

Time spent in forums: 2 h 23 m 2 sec
Reputation Power: 0

Cannot get correct MD5 hash with MySQL

Hello,

I unfortunately cannot use PHP to compare the plaintext password with the MD5 hash, I can only use mysql. The password needs to be placed into this format

md5(md5($login_password) . $salt)

and then compared, with the username, against the already hashed value in the database. I've been trying to do this but the hash value I get keeps being different from the one in the database.

I would really appreciate help!

November 4th, 2012, 09:06 PM

requinix

Still alive

Join Date: Mar 2007

Location: Washington, USA

Posts: 12,690

Folding Points: 417516 Folding Title: Super Ultimate Folder - Level 1

Time spent in forums: 5 Months 1 Week 4 Days 3 h 43 m 28 sec
Reputation Power: 8969

Send a message via Google Talk to requinix

Then the $login_password and/or $salt is incorrect.

Post code?

__________________
Site rules and FAQ | Project Suggestions | mod_rewrite guide | PHP New User Guide and FAQ - PHP Stickies | Regex Resources

November 4th, 2012, 09:18 PM

Brute

Registered User

Join Date: Nov 2012

Posts: 10

Time spent in forums: 2 h 23 m 2 sec
Reputation Power: 0

Neither are incorrect, this works perfectly with the same password and salt:

Code:

<?php
$username = "USERNAME";
$login_password = "PASSWORD";

$db = mysqli_connect('IP', 'USERNAME', 'PASSWORD', 'DATABASE'); 
if($query = mysqli_query($db, "SELECT `password` FROM `user` WHERE `username` = '$username'")){ 
  while($row = mysqli_fetch_assoc($query)){ 
    echo $row['password']; 
$dbpassword = $row['password'];
  } 
  mysqli_free_result($query); 
} 

if($query = mysqli_query($db, "SELECT `salt` FROM `user` WHERE `username` = '$username'")){ 
  while($row = mysqli_fetch_assoc($query)){ 
    echo $row['salt']; 
$salt = $row['salt'];
  } 
  mysqli_free_result($query); 
} 

$calculated_password_hash = md5(md5($login_password) . $salt);

if ($dbpassword == $calculated_password_hash)
{Print "Authentication Success!";}
else
{Print "Authentication Failed!";}
?>

select md5(concat(md5("password") + "." + salt));

November 5th, 2012, 01:58 AM

requinix

Still alive

Join Date: Mar 2007

Location: Washington, USA

Posts: 12,690

Time spent in forums: 5 Months 1 Week 4 Days 3 h 43 m 28 sec
Reputation Power: 8969

I stand corrected: either the password or salt is wrong, or you're doing the MD5 wrong.

1. + only works on numbers
2. CONCAT takes a list of arguments
3. The "." shouldn't be there

Code:

select md5(concat(md5("password"), salt));

November 5th, 2012, 06:28 AM

Brute

Registered User

Join Date: Nov 2012

Posts: 10

Time spent in forums: 2 h 23 m 2 sec
Reputation Power: 0

Sorry for my stupidity, MySQL isn't my strong point. I've tried what you posted and it still doesn't give the correct hashed password, I promise you that I am using the correct password and salt! Thank you for your help by the way, I really appreciate it!

I think it could be an issue with characters in the salt?

Code used:

select md5(concat(md5("TESTLPRPG5"), '}*KQPdB%q+ICkjeyKn5_(mKXT"k$E{'));

Password: TESTLPRPG5
Salt: }*KQPdB%q+ICkjeyKn5_(mKXT"k$E{
Hash in DB: 82a0d6862af55ff8d000bacc1f612b62
Calculated hash: 82a0d6862af55ff8d000bacc1f612b62

It works....but....

select md5(concat(md5("TESTLPRPG10"), "Ew>_5P*|2Hw`TF-^tok|h$ekM4O--M"));

Password: TESTLPRPG10
Salt: Ew>_5P*|2Hw`TF-^tok|h$ekM4O--M
Hash in DB: 10f1163c7b7360b4b64f00c650df791f
Calculated hash: 10f1163c7b7360b4b64f00c650df791f

...

select md5(concat(md5("TESTLPRPG23"), "?%h6ck;Yr14.2c1Q'u$#03(83`v4{v"));

Password: TESTLPRPG23
Salt: ?%h6ck;Yr14.2c1Q'u$#03(83`v4{v
Hash in DB: 9db9122cded8966bea6362e12e8f7856
Calculated hash: 9db9122cded8966bea6362e12e8f7856

...

select md5(concat(md5("TESTLPRPG1*"), "nW4<cr~qUXW743w9s&ImF?j#22kZYw"));

Password: TESTLPRPG1*
Salt: nW4<cr~qUXW743w9s&ImF?j#22kZYw
Hash in DB: 3a02a1fcf242a0c2726386e5756721a6
Calculated hash: 3a02a1fcf242a0c2726386e5756721a6

...DOESN'T WORK...

select md5(concat(md5("TEST00**2"), '>p1aM@\u|3ek>$TLpM\es3V"]@]h~d'));

Password: TEST00**2
Salt: >p1aM@\u|3ek>$TLpM\es3V"]@]h~d
Hash in DB: 4551cdac87c88d64263bade570ecbff4
Calculated hash: 0e2f6e295e3fc5104d8f0caa8c2c7281

...It works again...

select md5(concat(md5("TESTBLAH0**"), '}]xH1cA1]02F#+;=:CqQi^@"83xGRN'));

Password: TESTBLAH0**
Salt: }]xH1cA1]02F#+;=:CqQi^@"83xGRN
Hash in DB: 37065946bf9c771bcaba4062ae27ce6c
Calculated hash: 37065946bf9c771bcaba4062ae27ce6c

...DOESN'T WORK AGAIN...

select md5(concat(md5("TESTLPRPG"), "0!a\:i9+`G*k0)TyP\ldoe8*[.uC|T"));

Password: TESTLPRPG
Salt: 0!a\:i9+`G*k0)TyP\ldoe8*[.uC|T
Hash in DB: e7b91ef3c938f1db3f3a491a5ab541ed
Calculated hash: af656c9df37e1d2d02b57e30f03b8b41

..and again...

select md5(concat(md5("TESTLPRPG1"), "sxIm~UT7ez'{n5BLnF$qt\Sz?y>=yI"));

Password: TESTLPRPG1
Salt: sxIm~UT7ez'{n5BLnF$qt\Sz?y>=yI
Hash in DB: 760de195ae372d43823a97a9af61b56e
Calculated hash: f7c3c30418ba285e31e09131b5584dcd

November 5th, 2012, 11:14 AM

Problem Solver

Join Date: Jan 2001

Location: Stockholm, Sweden

Posts: 4,428

Time spent in forums: 3 Weeks 4 Days 7 h 17 m 23 sec
Reputation Power: 532

You problem are most certain the backslashes in the salt:

Code:

mysql> select 'hello\there';
+-------------+
| hello here |
+-------------+
| hello here |
+-------------+
1 row in set (0.00 sec)

Notice how "\t" get interpreted as a tab instead.

To escape it you need to have two consecutive backslashes:

Code:

mysql> select 'hello\\there';
+-------------+
| hello\there |
+-------------+
| hello\there |
+-------------+
1 row in set (0.00 sec)

Normally you solve this by using mysqli_real_escape_string().
But since you said you wanted to do all in MySQL I would just suggest that you avoid using backslashes and quotes (I noticed a single quote in one of your salts also) to avoid any possible problems.
Otherwise you will have to escape them with backslashes.

__________________
/Stefan

November 5th, 2012, 11:41 AM

Brute

Registered User

Join Date: Nov 2012

Posts: 10

Time spent in forums: 2 h 23 m 2 sec
Reputation Power: 0

That makes sense, I've found that as long as I use a salt variable and not plaintext then it works

. Thank you for all your help, I really appreciate it!

Cannot get correct MD5 hash with MySQL

Developer Shed Advertisers and Affiliates