PERL CGI Session / DBI MYSQL / MD5 Password Encryption

I am using CGI::Session to pass variables from page to page (DBI as the data source for session data). I want to use MD5 or other encryption to encrypt password.

I have a user table and a session table.

1. What is the best way to encrypt the password when a user creates an account?
    user submits a form with a password field.
    assuming I have checked for password rules(length,complexity,etc...)
    looking for the best way to insert the password into user table but encrypted  

2. What is the best way to check that the password?
    user submits a login form with a password field
    looking for the best way to check the plain text password against the encrypted password in the database

3. Should I...
    a. store the encrypted password in the session and check against user table
    b. store the plain text password in the session and check against user table using the same method as login (#2)?


Here is some of my session code...

#!/usr/bin/perl
####################################################################
use DBI;
use CGI::Session;
use CGI;

my $db_name="";
my $db_host="";
my $db_user="";
my $db_pass="";

$dbh = DBI->connect("DBI:mysql:database=$db_name;host=$db_host", "$db_user",
"$db_pass", {PrintError => 1, RaiseError => 1, AutoCommit => 1});

my $cgi = new CGI;
my $sid = $cgi->cookie('CGISESSID') || $cgi->param('CGISESSID') || undef;
my $session = new CGI::Session("driver:MySQL;id:MD5", undef, {Handle=>$dbh});


if ( $session->is_expired ) {
  #Your session is expired. Please Login
  #&expired;
  }
if (!$sid) {
  #No Session Exists. Please Login
  #&no_session;
  }
#Active Session;
if ($session_user && $session_pass) {
  #Username and Password are present
  #&check_user
  #if pass... continue OK session exists and username and password match
  #if fail... incorrect. Please Login
  }
elsif (!$session_user || !$session_pass) {
  #Account Error. Username or Password not present. Please Login
  }
$session->expire(1800);

$cookie = $cgi->cookie(CGISESSID => $session->id );
    print $cgi->header(-cookie=>$cookie);

$dbh->disconnect();
exit;



Start Free Trial