views:

138

answers:

1

Hi,

I have created a registration page using CI that works fine. However, I encoded the password using sha1 (see code snippet below), and now that I plan to create a login page, I need to check whether the password the user enters in the login page is the same as that password encoded using sha1 stored in the database. However, I just realized that sha1 is non-decodable.

So how do I use CI's encryption class to both encrypt and then decrypt this password for login purposes? Any assistance will be appreciated. Thanks in advance.

function register_user($username, $password, $name, $email, $activation_code){

 $sha1_password = sha1($password);  
 $query_str = "INSERT INTO table_name (username, password, name, email, activation_code) >VALUES (?,?,?,?,?)";    


$this->db-query($query_str, array($username, $sha1_password, $name, $email, $activation_code));

}

+2  A: 

There is no need to decrypt the password, only comparing for equality. That is all that is necessary for user identification.

Adrian
+1 Thanks for your reply Adrian. I'm new to this, but correct me if Im wrong: should I sha1 the login password and compare the two resultant hashes?
01010011
Yes thats what you should do. Also look into "Salting" the passwords so a rainbow table attack is not possible
Tom Schlick
@Adrian, thanks for confirming this and letting me know about salting. I've started searching for this, but I have not found any yet, so I'll keep searching.
01010011