Solved

some passwords cause query to return results, but some do not

Posted on 2013-06-12
4
215 Views
Last Modified: 2013-06-23
some passwords are sha1 other passwords are plain text
do not want to convert the plain text passwords because we want to see some passwords (I know it could be a security risk)

SELECT * FROM users WHERE (email='email' AND (pass='stravinsky1' or pass=SHA1('stravinsky1')))

but this does not work for
sha1(stravinsky1)
fc9bc17eea70a9c148869aca6414ddc4dc29e193

but when we convert password to sha1

SELECT * FROM users WHERE (email='email' AND (pass='fc9bc17eea70a9c148869aca6414ddc4dc29e193' or pass=SHA1('fc9bc17eea70a9c148869aca6414ddc4dc29e193')))
 no results returned (so user can not log in)


select sha1('12345')
8cb2237d0679ca88db6464eac60da96345513964

SELECT * FROM users WHERE (email='email2' AND (pass='8cb2237d0679ca88db6464eac60da96345513964' or pass=SHA1('8cb2237d0679ca88db6464eac60da96345513964')))

this query returns results

so password 12345 can be plain text or converted to sha1 and still work

so some passwords work using this query, others do not
0
Comment
Question by:rgb192
4 Comments
 
LVL 7

Expert Comment

by:Robert Saylor
ID: 39240807
I assume you are using php?

Why not use MD5 to encrypt it to the database then let php change it from cleartext to MD5 then compare apples to apples at MySQL?
0
 
LVL 15

Accepted Solution

by:
Jagadishwor Dulal earned 500 total points
ID: 39240958
Try using sh1 to field name like:

SELECT * FROM users WHERE (email='email' AND (pass='stravinsky1' or SHA1(pass)='stravinsky1'))

Open in new window

0
 
LVL 109

Expert Comment

by:Ray Paseur
ID: 39244717
Please post a few rows of test data showing both the clear-text password and the SHA1 password.  Please tell us how you encoded the SHA1 fields -- was it done in PHP or in SQL?
0
 

Author Closing Comment

by:rgb192
ID: 39270435
password can be plaintext or hidden now

thanks
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
SQL inner join confusion 15 55
MySQL Memory Keeps Increasing 4 47
Coldfusion/Mysql page error related to dynamic table creation. 9 32
issue with DB import 1 17
As a database administrator, you may need to audit your table(s) to determine whether the data types are optimal for your real-world data needs.  This Article is intended to be a resource for such a task. Preface The other day, I was involved …
I have been using r1soft Continuous Data Protection (http://www.r1soft.com/linux-cdp/) for many years now with the mySQL Addon and wanted to share a trick I have used several times. For those of us that don't have the luxury of using all transact…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question