How Do I Retrieve a Salted Password from the Database for User Authentication?

How to Retrieve a Salted Password from the Database for User Authentication

In an attempt to implement a membership site with salted passwords stored in MySQL, you may encounter issues with member login page accepting any input. This article addresses the problem, providing a solution based on the concept of password salting and hashing.

Password Salting and Hashing

To enhance security, passwords are often salted and hashed before being stored in the database. Salting involves adding a random string to the password, while hashing converts the result into a secure one-way value. This process prevents an attacker from directly retrieving the actual password even if they gain access to the database.

Retrieving the Salted Password

To retrieve the salted password, you need to:

1. Query the database for the salt: Use an SQL query to fetch the salt value associated with the user's name.
2. Concatenate the password and salt: Combine the user's input password with the retrieved salt.
3. Hash the concatenated value: Apply a hashing function to the salted password to generate the hashed value.

Verifying the Salted Password

Once the hashed value is obtained, you can verify it against the hashed password stored in the database:

$sqlQuery = "SELECT * FROM users WHERE name = '$name' AND password = '$hashedPW'";

if (mysqli_query($connect, $sqlQuery)){
    echo '<h1>Welcome to the member site '.$name.'</h1>';
}else{
    echo 'error adding the query: '.$sql_q.'<br> Reason: '.mysqli_error($connect);
}

In this code, if the hashed values match, the login is successful. Otherwise, an error is displayed.

Alternative Approach

Another approach for password verification is using the password_hash() and password_verify() functions:

$hashFromDb = ...; // retrieve the stored password hash

$isPasswordCorrect = password_verify($_POST['password'], $hashFromDb);

These functions automatically handle the salting and hashing process, simplifying password verification.

The above is the detailed content of How Do I Retrieve a Salted Password from the Database for User Authentication?. For more information, please follow other related articles on the PHP Chinese website!