md5 decrypt

jonofat
jonofat used Ask the Experts™
on
Hi. I am displaying a record but I encrypted it with MD5. I am not sure how to make it so that the proper word is visible using this;

<?php echo $row_Recordset1['customerpass']?>

I tried <?php echo $row_Recordset1(md5['customerpass'])?> but that didn't work...
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Top Expert 2011

Commented:
You can't decrypt md5 strings.
Top Expert 2011

Commented:
If you need to encrypt en decrypt information in a safe way you can use mcrypt,
a good article about it you can find here: http://www.itnewb.com/v/PHP-Encryption-Decryption-Using-the-MCrypt-Library-libmcrypt
MD5 is a ONE-WAY encryption. Technically it is a hash rather than an encryption.

Here is a link to an earlier question about using encryption/decryption.

http://www.experts-exchange.com/Web_Development/Web_Languages-Standards/PHP/Q_26868583.html#35068383

PMI ACP® Project Management

Prepare for the PMI Agile Certified Practitioner (PMI-ACP)® exam, which formally recognizes your knowledge of agile principles and your skill with agile techniques.

You did the right thing to encrypt the password. This nice thing about MD5 is that it makes it so nobody can know the original password.

To allow the user to reset a forgotten password, here's my quick outline.

Have a field in the customer record called random_token
When the customer requests to reset the password. Set this field to a random value and email (to an email already on file)  them a link something like this mysite.com/pass_reset.php?id=123$token=246457854
That program will compare the token with the one you stored in the customer's record. (make sure token=0 is not accepted)
If they match, allow the customer to enter a new password and confirm password. Encrypt these with MD5 and update the customers record.
Whether or not it matches, at this point reset the random_token to zero. This will prevent hackers from writing a script to try all possible tokens.

Hope that helps
Mohamed AbowardaSenior Software Engineer
Commented:
MD5 is actually calculation, it can calculate the MD5 hash of string, files, or any data, therefore you can't decrypt it directly since it generate a fixed number of bytes no matter what's the original data is (i.e: the md5 hash of 500 MB data is only fixed 128-bit) you can't convert 128-bit back to 500 MB, the only way is that you use a website that try to find the original data using large amount of strings and their md5.

http://www.md5decrypter.com
http://www.md5decrypter.co.uk

Author

Commented:
Michael701, I am trying to do what you recommended. I have done the following so far...

When a user types in their email address it is stored in a new table I created which stores their email address and token which is md5 random number. It then emails them this and the link looks like this:

http://myurl.com/reset_password.php?token=d86f7a3927be034eac22601be4b07750&custid=3548

What I want to happen now is that when they click on that link, it must change their password in the database to a new random md5 password and then email them that password recommending that they login with it and change it to something they want.

What is the best way to do this? Surely when they click that link, it should also delete the email address and token from the temp table?
Close, but the token doesn't have to be MD5 encoded, only their password should be.

Instead of emailing them the new password it should work this why.

They say they lost their password.
Set the token to a random number.
email then a reset link (like you have without MD5 on the token)
reset_password.php will read their ID and compare the URL token to the one stored in the database. If they agree display a 'Change password form' have hidden fields with the customer id and token. Upon 'submit' reverify the id, token and that the two new passwords match, then update the customer record with the new MD5(password) also set the token back to zero.

Hope this helps.

Author

Commented:
Okay, I have sort of got it. THe only problem is that when I click on the link in the email It goes to the right url but I get an error:

Error 404 Page Not Found
The requested URL /reset_password.php?token=1997881a220ff6eb339f7d5de16fdf1f&customerid=3 was not found on this server.

but in the address bar is the full url. Weird?
first, you *DO* have a reset_password.php program?

Next, try adding http://www.mysite.com/ to the email address

Author

Commented:
I have the following code on reset_password.php

$colname_Recordset1 = "-1";
if (isset($_GET['token'])) {
  $colname_Recordset1 = $_GET['token'];
}
$colname2_Recordset1 = "-1";
if (isset($_GET['customerid'])) {
  $colname2_Recordset1 = $_GET['customerid'];
}
mysql_select_db($database_test, $test);
$query_Recordset1 = sprintf("SELECT customerid, customeremail, random_token, customerpass FROM customers WHERE random_token = %s AND customerid = %s", GetSQLValueString($colname_Recordset1, "text"),GetSQLValueString($colname2_Recordset1, "int"));
$Recordset1 = mysql_query($query_Recordset1, $test) or die(mysql_error());
$row_Recordset1 = mysql_fetch_assoc($Recordset1);
$totalRows_Recordset1 = mysql_num_rows($Recordset1);

Open in new window

Author

Commented:
Never mind, I was being an idiot. There was a small spelling mistake in the URL.
If you cut and paste the url from the email does it work?

Author

Commented:
Ok, my problem now is getting the info from the url to the page. If I do it with just the customer ID it works fine but as soon as I try involve the token, I get no result. I want to use them both together... This doesn't work..

$colname_Recordset1 = "-1";
if (isset($_GET['token'])) {
  $colname_Recordset1 = $_GET['token'];
}
mysql_select_db($database_test, $test);
$query_Recordset1 = sprintf("SELECT customerid, customeremail, customerpass, random_token FROM customers WHERE random_token = %s", GetSQLValueString($colname_Recordset1, "text"));
$Recordset1 = mysql_query($query_Recordset1, $test) or die(mysql_error());
$row_Recordset1 = mysql_fetch_assoc($Recordset1);
$totalRows_Recordset1 = mysql_num_rows($Recordset1);

Open in new window


This does work:

$colname_Recordset1 = "-1";
if (isset($_GET['customerid'])) {
  $colname_Recordset1 = $_GET['customerid'];
}
mysql_select_db($database_test, $test);
$query_Recordset1 = sprintf("SELECT customerid, customeremail, customerpass, random_token FROM customers WHERE customerid = %s", GetSQLValueString($colname_Recordset1, "int"));
$Recordset1 = mysql_query($query_Recordset1, $test) or die(mysql_error());
$row_Recordset1 = mysql_fetch_assoc($Recordset1);
$totalRows_Recordset1 = mysql_num_rows($Recordset1);

Open in new window


This is what I want but doesn't work either:

$colname_Recordset1 = "-1";
if (isset($_GET['token'])) {
  $colname_Recordset1 = $_GET['token'];
}
$colname2_Recordset1 = "-1";
if (isset($_GET['customerid'])) {
  $colname2_Recordset1 = $_GET['customerid'];
}
mysql_select_db($database_test, $test);
$query_Recordset1 = sprintf("SELECT customerid, customeremail, customerpass, random_token FROM customers WHERE random_token = %s AND customerid = %s", GetSQLValueString($colname_Recordset1, "text"),GetSQLValueString($colname2_Recordset1, "int"));
$Recordset1 = mysql_query($query_Recordset1, $test) or die(mysql_error());
$row_Recordset1 = mysql_fetch_assoc($Recordset1);
$totalRows_Recordset1 = mysql_num_rows($Recordset1);

Open in new window


Don't MD5 the token, it should just be a large random number. say between 100000 and 999999

Author

Commented:
Why not MD5 the token? WHen I have forgotten my password on other sites, the email I receive has a MD5 token.

Author

Commented:
Why would it make a difference if I use MD5? The md5 in the database is exactly the same as the one in the URL
You right there it shouldn't matter. Just easier to debug.

Are you saying that you get zero records returned from the sql statement?

Let's see the sql command

add this after you set the variable

echo $query_Recordset1;

post the results

Author

Commented:
SELECT customerid, customeremail, customerpass, random_token FROM customers WHERE random_token = '5d43d368994ef0eaae351493c99985cf'

Author

Commented:
Yes, when I put this on the page there is no value when there should be.

<?php echo $row_Recordset1['customeremail']; ?>

echo the $query_Recordset1 before the $row_Recordset1

It seems like there is something amiss about the query itself cause no results to be returned.

FYI: Most of the time I ask people to echo the sql query it become one of the DUH, I see the problem. BUt echo the query and post the raw sql commands for review

Author

Commented:
Not sure if I am putting it in the right place what you are asking for?

mysql_select_db($database_test, $test);
$query_Recordset1 = sprintf("SELECT customerid, customeremail, customerpass, random_token FROM customers WHERE random_token = %s", GetSQLValueString($colname_Recordset1, "text"));
$Recordset1 = mysql_query($query_Recordset1, $test) or die(mysql_error());
echo $query_Recordset1;
$row_Recordset1 = mysql_fetch_assoc($Recordset1);
$totalRows_Recordset1 = mysql_num_rows($Recordset1);

Open in new window


After running the above code I got :

SELECT customerid, customeremail, customerpass, random_token FROM customers WHERE random_token = '5d43d368994ef0eaae351493c99985cf'
that will work. but let's try something else.

use the select ... where customerid=

then add these echo statements

echo $colname_Recordset1. "\n<br />";
echo $row_Recordset1['random_token']. "\n<br />";

Let's see if the really match. Paste the reply.

Author

Commented:
Okay, I used this code:

$colname_Recordset1 = "-1";
if (isset($_GET['token'])) {
  $colname_Recordset1 = $_GET['token'];
}
$colname2_Recordset1 = "-1";
if (isset($_GET['customerid'])) {
  $colname2_Recordset1 = $_GET['customerid'];
}
mysql_select_db($database_test, $test);
$query_Recordset1 = sprintf("SELECT customerid, customeremail, customerpass, random_token FROM customers WHERE random_token = %s AND customerid = %s", GetSQLValueString($colname_Recordset1, "text"),GetSQLValueString($colname2_Recordset1, "int"));
$Recordset1 = mysql_query($query_Recordset1, $test) or die(mysql_error());
echo $colname_Recordset1. "\n<br />";
echo $row_Recordset1['random_token']. "\n<br />";
echo $colname2_Recordset1. "\n<br />";
echo $row_Recordset1['customerid']. "\n<br />";
$row_Recordset1 = mysql_fetch_assoc($Recordset1);
$totalRows_Recordset1 = mysql_num_rows($Recordset1);

Open in new window


and from the code you asked me to input, the display was

5d43d368994ef0eaae351493c99985cf

3

which is correct since email I received shows token=5d43d368994ef0eaae351493c99985cf&customerid=3
That's odd that all the token match, but you can't seem to Select where token=

ANyway, it's better to select by id then compare the tokens. I'llassume that id is an index field and token is not.

so let's do this, after the select where id=

if {$row_Recordset1['random_token']==$colname_Recordset1}
{
  echo "Tokens match<br />\n";
  \\ you can place the html form here.
}

Author

Commented:
Yep, I got the message:

Tokens match

Author

Commented:
However, I changed the token and I still get the same message : Tokens match

Author

Commented:
Okay, I changed it a bit. Now it just says : "Don't match" no matter what I do....

$colname_Recordset1 = "-1";
if (isset($_GET['customerid'])) {
  $colname_Recordset1 = $_GET['customerid'];
}
$coltoken_Recordset1 = "-1";
if (isset($_GET['token'])) {
  $coltoken_Recordset1 = $_GET['token'];
}
mysql_select_db($database_test, $test);
$query_Recordset1 = sprintf("SELECT customerid, customeremail, customerpass, customername, customerlastname, random_token FROM customers WHERE customerid = %s AND random_token = %s", GetSQLValueString($colname_Recordset1, "int"),GetSQLValueString($coltoken_Recordset1, "text"));
$Recordset1 = mysql_query($query_Recordset1, $test) or die(mysql_error());
if ($row_Recordset1['random_token']==$coltoken_Recordset1) {
echo "Tokens match<br />\n";
   }else{
	     echo "don't match";
   }
$row_Recordset1 = mysql_fetch_assoc($Recordset1);
$totalRows_Recordset1 = mysql_num_rows($Recordset1);

Open in new window

that's because you haven't yet gotten the row data. move the fetch_assoc up a bit in the code
$row_Recordset1 = mysql_fetch_assoc($Recordset1);
if ($row_Recordset1['random_token']==$coltoken_Recordset1) {
echo "Tokens match<br />\n";
   }else{
	     echo "don't match";
   }

Open in new window

Author

Commented:
Haha. Never mind. I figured out that the probelm is something else! The record isn't updating and so the token never changes. For some reason when the form submits the record isn't updating.

<form action="<?php echo $editFormAction; ?>" id="form1" name="form1" method="POST">
          <table width="65%" border="0" align="center" cellpadding="2" cellspacing="2">
            <tr>
              <td width="9%">&nbsp;</td>
              <td bgcolor="#D71820"><span class="headingtext">FORGOTTEN PASSWORD<strong>
<input name="token" type="hidden" id="token" value="<?php echo md5(mt_rand()); ?>" />
                    <input name="customerid" type="hidden" id="customerid" value="<?php echo $row_Recordset1['customerid']; ?>" />
              </strong></span></td>
            </tr>
            <tr>
              <td>&nbsp;</td>
              <td class="headingtext">If that email address is registered with us, you should receive an email shortly. </td>
              </tr>
          </table>
          <input type="hidden" name="MM_update" value="form1" />
        </form>
        <script>
document.form1.submit();
</script>

Open in new window

It's best to echo the UPDATE sql command and look for obvious errors. Post here is you need help

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial