Solved

SSL vs MD5??

Posted on 2010-08-25
10
457 Views
Last Modified: 2013-12-13
I have developed a user login for a customer portal on my website (code below). I believe I have it md5 encrypted… (please correct me if I am wrong) – passwords on the database are still plain text… Is this secure?

Also – if this is so far the only security on my site do I also need an SSL certificate? What is the difference? Any help would be great. Thanks!

<?php
$username = $_POST['username'];
$password = md5($_POST['password']);

if ($username&&$password)
{
	
	$connect = mysql_connect("xxxx", "xxxx", "xxxx") or die("Connection Error!");
	mysql_select_db("xxxx") or die("Couldn't find db");
	
	$query = mysql_query("SELECT * FROM users WHERE username='$username'");
	
	$numrows = mysql_num_rows($query);
	
	if ($numrows!=0)
	{
		while ($row = mysql_fetch_assoc($query))
{
	$dbusername = $row['username'];
	$dbpassword = $row['password'];
}

if($username==$dbusername&&$password==md5($dbpassword))
{
	echo "Success!";
	
}
else
echo "Incorrect password!";

	}
	
	else
	die ("That user doesnt exist.");
	
}
else
die("Please enter username and password.");

?>

Open in new window

0
Comment
Question by:brettsky07
10 Comments
 
LVL 6

Expert Comment

by:Patrick Tallarico
ID: 33524116
This may protect your password from being sniffed on a network, but it doesn't protect the username, or any data that is transmitted after authentication.
If your clients will be handling sensitive data while on this web site, I would strongly suggest SSL.
0
 
LVL 4

Expert Comment

by:darkyin87
ID: 33524166
what you have you can do is. md5 your password and then save it into your database rather than saving it as plain text. In which the password in your database will be encrypted and even if people get access to the database they wont be able to crack it.

 I would recommend you to get an SSL atleast a shared SSL.
0
 

Author Comment

by:brettsky07
ID: 33524171
So is that all i need for md5 encryption? or is there something i need to do to the actual database as well?
0
Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

 
LVL 4

Expert Comment

by:darkyin87
ID: 33524236
Yeas that is all you need. You can do the same thing in MYSQL side too. MYSQL also supports a variety of encrytion. refer this page:
http://dev.mysql.com/doc/refman/5.1/en/encryption-functions.html
0
 

Author Comment

by:brettsky07
ID: 33524273
is it necessary to do mysql encryption as well if i get a ssl certificate? Would the certificate protect the database?
0
 
LVL 4

Expert Comment

by:darkyin87
ID: 33524309
Security is needed in 3 areas

1) Client Side: Using Javascript

2) On the network: Done by sending encrypted data and sending data using SSL

3) Server Side: Using encrytion like md5
0
 

Author Comment

by:brettsky07
ID: 33524370
Ok. Thanks for all your help!
0
 
LVL 27

Accepted Solution

by:
Tolomir earned 250 total points
ID: 33525871
md5 is no encryption it is a hash function.

There is no way to get the original value from a hash value without brute force hashing all values into a hash value.

For details see: http://en.wikipedia.org/wiki/MD5

So: If you use a http connection the user sends his password unencrypted over the internet (or local lan) on the server the password is md5 hashed and compared to the md5 hash value stored in database.
Someone sniffing the network can easily extract the usename + password.

so if you send passwords over the internet ALWAYS use SSL (https://) Connections.

Tolomir
0
 
LVL 27

Assisted Solution

by:Lukasz Chmielewski
Lukasz Chmielewski earned 250 total points
ID: 33526481
For what it seems you are not storing your passwords as a plain text - you are checking if the hash is equal to the hash soterd in the database...
0
 

Author Comment

by:brettsky07
ID: 33571233
Thanks so much for everyone's help! I will for sure get an SSL cert.
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Each year, investment in cloud platforms grows more than 20% (https://www.immun.io/hubfs/Immunio_2016/Content/Marketing/Cloud-Security-Report-2016.pdf?submissionGuid=a8d80a00-6fee-4b85-81db-a4e28f681762) as an increasing number of companies begin to…
Many businesses neglect disaster recovery and treat it as an after-thought. I can tell you first hand that data will be lost, hard drives die, servers will be hacked, and careless (or malicious) employees can ruin your data.
Explain concepts important to validation of email addresses with regular expressions. Applies to most languages/tools that uses regular expressions. Consider email address RFCs: Look at HTML5 form input element (with type=email) regex pattern: T…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

828 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question