Mysql SHA salt

Question

Hello,

I am setting a cookie something like:

$_COOKIE['test'] = SHA1('124'.'mysalt');

Now 124 is my id which i want. So in my mysql table, I am trying to run a query like:

$sql = ("SELECT * FROM users WHERE SHA1(`id`) = '".mysql_real_escape_string($_COOKIE['test'])."'");

Problem is how to do I add the "mysalt" to the sql query? Because else I want get the correct id.

Thank you for your time.

Answer 1

Use can use Concat() for that.

SELECT ... Sha1( Concat(`id`, 'mysalt') )=...

Answer 2

The query should be:

$sql = ("SELECT * FROM users WHERE SHA1(CONCAT(`id`,`mysalt`)) = '".mysql_real_escape_string($_COOKIE['test'])."'");

if I understand correctly what you're trying to do.

Answer 3

Use CONCAT:

$sql = ("SELECT * FROM users WHERE SHA1(CONCAT(`id`,'mysalt')) = '".mysql_real_escape_string($_COOKIE[''test''])."'");

Answer 4

The solutions already provided probably will work just fine, however are you certain you want to do this? If the field "id" is really a distinct identification you can use "LIMIT 1" to stop mysql from searching thru all your items. Another thing is, why don't you use a separate precomputed field for this? I mean in every query mysql unnecessarily needs to compute all these sha1 values.. One last thing. I'm uncertain why you are using your approach, but my best guess is to implement some sort of session key. I thing this is a bad idea for a couple of reasons: If someone gets holds on your salt, he has access to all your accounts. If someone sniffs one "session" he can reuse it whenever he wants to. Choosing a weak salt could have serious consequences. HTH.