tags:

views:

136

answers:

2

I'm trying to see if a user logging in has entered the right password, which is stored as an md5 hash. when i echo the hash of the password entered, it matches exactly the hash of the one in the database, but it still thinks its false. Heres the code:

echo md5($_POST['pass']);

if ($user->match_password($_POST['pass']) == true) {

    ...

} else {

    ...

}

it tries to execute the else code above ^

class user {

    ...

    var $password;

    ...

    function user($id) {
     global $DB;
     $this->db = new db($DB['host'], $DB['user'], $DB['pass'], $DB['database']);

     $this->user_id = $id;
     $u_result = $this->db->run("select * from users where use_id = " . $this->db->escape($this->user_id));

     ...

     $this->password = $u_reuslt[0]['password'];

            ...
    }

        ...

    function match_password($password) {
     return ($this->password == md5($password));
    } 
}
+1  A: 

see in the DB the password field , if the md5 password insert correctly , maybe cut because not have enough length.

Second, what kind of column is password? It should be a

tinyblob OR BINARY(32)

, because the results of an md5 hash can be mangled if stored in a varchar.

links :

http://www.experts-exchange.com/Web/Web_Languages/PHP/Q_21578660.html

http://forums.mysql.com/read.php?30,16535,16617#msg-16617

Haim Evgi
what i did to test that is i echo'd the hash from the posted password, copied and pasted that into a query in phpmyadmin and ran it to match the row, and it matched. so i know they are the same.
The.Anti.9
i edit the answer
Haim Evgi
+5  A: 

You typoed your variables, see comment above.

E_ALL is your friend. ;o)

deceze