SSL vs MD5??

I have developed a user login for a customer portal on my website (code below). I believe I have it md5 encrypted… (please correct me if I am wrong) – passwords on the database are still plain text… Is this secure?

Also – if this is so far the only security on my site do I also need an SSL certificate? What is the difference? Any help would be great. Thanks!

<?php
$username = $_POST['username'];
$password = md5($_POST['password']);

if ($username&&$password)
{
	
	$connect = mysql_connect("xxxx", "xxxx", "xxxx") or die("Connection Error!");
	mysql_select_db("xxxx") or die("Couldn't find db");
	
	$query = mysql_query("SELECT * FROM users WHERE username='$username'");
	
	$numrows = mysql_num_rows($query);
	
	if ($numrows!=0)
	{
		while ($row = mysql_fetch_assoc($query))
{
	$dbusername = $row['username'];
	$dbpassword = $row['password'];
}

if($username==$dbusername&&$password==md5($dbpassword))
{
	echo "Success!";
	
}
else
echo "Incorrect password!";

	}
	
	else
	die ("That user doesnt exist.");
	
}
else
die("Please enter username and password.");

?>

Open in new window

brettsky07Asked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
TolomirConnect With a Mentor AdministratorCommented:
md5 is no encryption it is a hash function.

There is no way to get the original value from a hash value without brute force hashing all values into a hash value.

For details see: http://en.wikipedia.org/wiki/MD5

So: If you use a http connection the user sends his password unencrypted over the internet (or local lan) on the server the password is md5 hashed and compared to the md5 hash value stored in database.
Someone sniffing the network can easily extract the usename + password.

so if you send passwords over the internet ALWAYS use SSL (https://) Connections.

Tolomir
0
 
Patrick TallaricoFSEP Systems AnalystCommented:
This may protect your password from being sniffed on a network, but it doesn't protect the username, or any data that is transmitted after authentication.
If your clients will be handling sensitive data while on this web site, I would strongly suggest SSL.
0
 
darkyin87Commented:
what you have you can do is. md5 your password and then save it into your database rather than saving it as plain text. In which the password in your database will be encrypted and even if people get access to the database they wont be able to crack it.

 I would recommend you to get an SSL atleast a shared SSL.
0
The Lifecycle Approach to Managing Security Policy

Managing application connectivity and security policies can be achieved more effectively when following a framework that automates repeatable processes and ensures that the right activities are performed in the right order.

 
brettsky07Author Commented:
So is that all i need for md5 encryption? or is there something i need to do to the actual database as well?
0
 
darkyin87Commented:
Yeas that is all you need. You can do the same thing in MYSQL side too. MYSQL also supports a variety of encrytion. refer this page:
http://dev.mysql.com/doc/refman/5.1/en/encryption-functions.html
0
 
brettsky07Author Commented:
is it necessary to do mysql encryption as well if i get a ssl certificate? Would the certificate protect the database?
0
 
darkyin87Commented:
Security is needed in 3 areas

1) Client Side: Using Javascript

2) On the network: Done by sending encrypted data and sending data using SSL

3) Server Side: Using encrytion like md5
0
 
brettsky07Author Commented:
Ok. Thanks for all your help!
0
 
Lukasz ChmielewskiConnect With a Mentor Commented:
For what it seems you are not storing your passwords as a plain text - you are checking if the hash is equal to the hash soterd in the database...
0
 
brettsky07Author Commented:
Thanks so much for everyone's help! I will for sure get an SSL cert.
0
All Courses

From novice to tech pro — start learning today.