Indie-Resource.com

Code: Select all

/**
	* checks the users login credital 
	* @param $username username to check
	* @param $password user password to check
	* @return true if login is successful otherwise false
	*/
	public function checkLogin($username, $password, $rounds = 12)
	{
		// generate the hash of the password
		$hashedpassword = $this->generateHash($password);

		// prepare the sql statement
		$statement = $this->db->prepare('SELECT password FROM ' . TABLE_USERS . ' WHERE USERNAME = ? LIMIT 1');

		// bing the variables
		$statement->bind_param('s', $username);

		// if the statement executed successfully
		if ($statement->execute())
		{
			// get the number of results
			$statement->bind_result($result);

			// fetch the results
			$statement->fetch();

			// if a result exists
			if($result)
			{
				// if the password matches
				if($hashedpassword == crypt($password, $result))
				{
					// return true
					return true;
				}
				// otherwise the password is incorrect
				else
				{
					// return false
					return false;
				}

			// otherwise return false
			return false;
			}
        }
	}

Code: Select all

f(crypt($password, $hashedpassword) == $hashedpassword)

Code: Select all

if(substr($passwordhash, 0, 60) == crypt($password, "$2a$" . $rounds . substr($result, 60)))

Code: Select all

if($hashedpassword == crypt($password, $result))

Code: Select all

if($hashedpassword == $result)

Code: Select all

// DEBUG
echo $result . "<br />"
echo $hashedpassword . "<br />"

Code: Select all

/**
	* Generates a hash
	* @param $password password to hash
	* @return hashed password
	*/
	public function generateHash($password, $rounds = 12)
	{
		// list the characters valid in the salt
		$validcharacters = array_merge(range('A', 'Z'), range('a', 'z'), range('0', '9'));
		
		// repeat the loop 22 times cause the salt is 22 characters
		for($i = 0; $i < 22; $i++)
		{
			// generate the salt
			$salt .= $validcharacters[array_rand($validcharacters)];
		}

		// return the password hash using crypt
		return crypt($password, sprintf('$2a$%02d$', $rounds) . $salt);
	}

Code: Select all

<?php

	// support for crypt blowfish?
	if (CRYPT_BLOWFISH == 1)
	{
		// display support message
		echo "Crypt Blowfish Supported<br />";
	}
	// otherwise crypt blowfish isn't supported'
	else
	{
		// display nonsupport message
		echo "Crypt Blowfish Unsupported<br />";
	}

	// password 1
	$password1 = "robinandstarfiregotothemovies";

	// password 1 hash(represents user entered password)
	$password1hash = generateHash($password1);

	// password 2
	$password2 = "robinandstarfiregotothemovies";

	// password 2 hash(represents password in database)
	$password2hash = generateHash($password2);

	//rounds to run encryption
	$rounds = 12;

	// DEBUG
	echo "password1 = " . $password1 . "<br/>";
	echo "password1 length = " . strlen($password1) . "<br />";
	echo "password1hash = " . $password1hash . "<br />";
	echo "password1hash length = " . strlen($password1hash) . "<br />";
	echo "password2 = " . $password2 . "<br/>";
	echo "password2 length = " . strlen($password2) . "<br />";
	echo "password2hash = " . $password2hash . "<br />";
	echo "password2hash length = " . strlen($password2hash) . "<br />";
	echo "rounds = " . $rounds . "<br />";

	// if the password matches
	if(substr($password1hash, 0, 60) == crypt($password1, "$2a$" . $rounds . substr($password2hash, 60)))
	{
		// return true
		echo "Login Test 1 Successful<br />";
	}
	// otherwise the password is incorrect
	else
	{
		// return false
		echo "Login Test 1 Unsuccessful<br />";
	}

	// if the password matches
	if(crypt($password1, $password1hash) == $password2hash)
	{
		// return true
		echo "Login Test 2 Successful<br />";
	}
	// otherwise the password is incorrect
	else
	{
		// return false
		echo "Login Test 2 Unsuccessful<br />";
	}

	// if the password matches
	if($password1hash == $password2hash)
	{
		// return true
		echo "Login Test 3 Successful<br />";
	}
	// otherwise the password is incorrect
	else
	{
		// return false
		echo "Login Test 3 Unsuccessful<br />";
	}

	/**
	* Generates a hash
	* @param $password password to hash
	* @return hashed password
	*/
	function generateHash($password, $rounds = 12)
	{
		// list the characters valid in the salt
		$validcharacters = array_merge(range('A', 'Z'), range('a', 'z'), range('0', '9'));

		// repeat the loop 22 times cause the salt is 22 characters
		for($i = 0; $i < 22; $i++)
		{
			 // generate the salt
			$salt .= $validcharacters[array_rand($validcharacters)];
		}

		// return the password hash using crypt
		return crypt($password, sprintf('$2a$%02d$', $rounds) . $salt);
	}

?>