Registration form to MySQL - Password data type

[Muppsy007]

Hi ho,

One questions please:

I have made a registration page for my site and everything works fine (It inserts a new record into a MySQL table, diverts to new page etc etc).

On the form, there is a password field, which in turn populates a password field in the table.

The php code on the reg page is as follows:

<?php
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "")
{
$theValue = (!get_magic_quotes_gpc()) ? addslashes($theValue) : $theValue;

switch ($theType) {
case "text":
$theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
break;
case "long":
case "int":
$theValue = ($theValue != "") ? intval($theValue) : "NULL";
break;
case "double":
$theValue = ($theValue != "") ? "'" . doubleval($theValue) . "'" : "NULL";
break;
case "date":
$theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
break;
case "defined":
$theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
break;
}
return $theValue;
}

$editFormAction = $_SERVER['PHP_SELF'];
if (isset($_SERVER['QUERY_STRING'])) {
$editFormAction .= "?" . htmlentities($_SERVER['QUERY_STRING']);
}

if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "register_form")) {
$insertSQL = sprintf("INSERT INTO contacts (UserGroup, Username, Password, UserFullname, UserPrimaryEmail, UserSecondEmail, UserWebAddress, UserAddress1, UserAddress2, UserAddress3, UserAddress4, UserAddress5, UserPhone, UserMobile, UserDOB) VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s)",
GetSQLValueString($_POST['usergroup'], "text"),
GetSQLValueString($_POST['username'], "text"),
GetSQLValueString($_POST['password'], "text"),
GetSQLValueString($_POST['fullname'], "text"),
GetSQLValueString($_POST['primary_email'], "text"),
GetSQLValueString($_POST['second_email'], "text"),
GetSQLValueString($_POST['web_address'], "text"),
GetSQLValueString($_POST['address1'], "text"),
GetSQLValueString($_POST['address2'], "text"),
GetSQLValueString($_POST['address3'], "text"),
GetSQLValueString($_POST['address4'], "text"),
GetSQLValueString($_POST['address5'], "text"),
GetSQLValueString($_POST['home_phone'], "text"),
GetSQLValueString($_POST['mobile_phone'], "text"),
GetSQLValueString($_POST['DOB'], "date"));

mysql_select_db($database_contacts_db, $contacts_db);
$Result1 = mysql_query($insertSQL, $contacts_db) or die(mysql_error());

$insertGoTo = "index_temp.php";
if (isset($_SERVER['QUERY_STRING'])) {
$insertGoTo .= (strpos($insertGoTo, '?')) ? "&" : "?";
$insertGoTo .= $_SERVER['QUERY_STRING'];
}
header(sprintf("Location: %s", $insertGoTo));
}
?>

What I want to do is use the Password function in MySQL to encrypt the password. If have searched this forum and come across a function called MD5 but my attempts to mimic it's use have all ended in "Password field cannot be blank" messages. Can you simply set MySQL to treat the entire column as passwords, or does it have to be done at php level.

Thanks in advance
Aaron

 

[Chacalinc]

you can set the encrypted password at MySQL level, example:

INSERT INTO table (user,password) VALUES ('user_id', PASSWORD('password'))

encrypted password has 32 char lenght (plus the \n, 33).

Now, in PHP you can make comparations with:

PHP side: MD5($password) = MySQL side: PASSWORD ('password')

http://cl2.php.net/manual/en/function.md5.php

Hope this can help you.

Cheers.

 

[DRJ478]

In a SQL query you would just plug in the password into a select statement that checks for username/password match:

$SQL = 'SELECT count(username) AS match FROM tabel WHERE username="'.$username.'" AND column_password=PASSWORD("'.$password.'")';

Then just check if $row['match'] == 1.

 

[Muppsy007]

BLOODY CHRISTMAS!!!

Thanks both of you, she's firing on all cylinders now thanks to you.

Thanks Again.
Aaron