base64_encode weird behavior

Question

I'm doing something like the following:

SELECT * FROM table WHERE user='$user';
$myrow = fetchRow() // previously I inserted a pass to the db using base64_encode ex: WRM2gt3R=

$somepass = base64_encode($_POST['password']);

if($myrow[1] != $somepass) echo 'error';
else echo 'welcome';

Im always getting error, I even echo $somepass and $myrow[1] they are the same, but still error. What Am I doing wrong? Thanks

Answer 1

Try using var_dump instead of echo - maybe one of them has a space or newline at the start/end.

Edit:

You must be storing it as CHAR(40): A fixed-length string that is always right-padded with spaces to the specified length when stored

Use VARCHAR or trim()

Answer 2

If $myrow[1] is actually the correct password in base64-encoding, I don't see any errors.

Try this ind the end:

echo "<br />$myrow[1] != $somepass";

What does it say?

And by the way: I don't see any reason to base64-encode the passwords. What are you trying to accomplish?

Answer 3

I think somehow if I do a var_dump() I get:

string(40) "YWRraM2= " string(8) "YWRraM2="

seems like somehow if I insert the data into the db using the console its adding an extra space to the pass field.

myplacedk: is there any reason why I should not be doing it? I thought it will add an extra leyer of security?

Answer 4

This encoding does two things:

1. It adds code, making it more complex and easier to make errors
2. If you view your database on your screen, and someone looks over your shoulder, the passwords may be a bit harder to remember.

So no, it doesn't really add any security. It's just an encoding, it's easy to decode.

Maybe you are mistaking it for md5-hashing or something like that.

Playing around is great, but when it comes to security, I really recommend not using something you don't understand. In the long run, it will do more damage than good.

Answer 5

Some issues:

• From your comments elsewhere, I guess that the problem with the current code is that your database field is CHAR(40). A CHAR field always has a fixed size. Try changing the database field type to VARCHAR instead of CHAR.
  
  
• Using base64_encode before storing in a database is nowhere near secure. Good practice is storing only a one-way hash of the password in the database -- typically md5 or (better) sha1. Then, when the user wants to log in, use the same hash-function on the provided password, and then compare the two hashes.
  This has the added benefit of working with passwords longer than 40 characters too.
  A sha1 or md5-hash always takes a fixed amount of space, so if you go this route, you don't have to switch your database column to VARCHAR :)