php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Doc Bug #38986 Wrong example 1 -> Hash values of Password
Submitted: 2006-09-28 20:49 UTC Modified: 2006-10-05 11:13 UTC
From: charlie28u798r at web dot de Assigned:
Status: Not a bug Package: Documentation problem
PHP Version: Irrelevant OS:
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: charlie28u798r at web dot de
New email:
PHP Version: OS:

 

 [2006-09-28 20:49 UTC] charlie28u798r at web dot de
Description:
------------
There are 2 examples given in the documentation of crypt(), which cant work the way their shown.

Example 2 will, as read in the documentation, give a different hash values each time its called. But it looks like its supposed to give the same hash for same passwords so a user given password can be compared with the one saved in a databank (or the on in htpasswd).

<?php
// Set the password
$password = 'mypassword';

// Get the hash, letting the salt be automatically generated
$hash = crypt($password);
?>

Reproduce code:
---------------
On the other hand example 1 is not clear. This wont work either, unless $user_input is given and it won't really state what it should do. From the code i would state it should be used to compare passwords, but like i said its not clear.

<?php
$password = crypt('mypassword'); // let the salt be automatically generated

/* You should pass the entire results of crypt() as the salt for comparing a
   password, to avoid problems when different hashing algorithms are used. (As
   it says above, standard DES-based password hashing uses a 2-character salt,
   but MD5-based hashing uses 12.) */
if (crypt($user_input, $password) == $password) {
   echo "Password verified!";
}
else echo "Wrong Password";
?> 

Expected result:
----------------
Password verified

Actual result:
--------------
Wrong Password

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-10-05 11:13 UTC] colder@php.net
Because the salt is random, the resulting hash will be random.
To test this hash against an user input, you'll use $hash as the salt: if(crypt($input, $hash) == $hash)

The hash can always be used as the salt:
crypt($p, crypt($p, $salt)) == crypt($p, $salt) // true

Example1 looks perfectly clear to me.
Example2 is correct, apache handles crypt()'ed passwords.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu May 23 05:01:31 2024 UTC