Is it possible to check a md5 password

Question

More precisely: i want to check if the user enters his same password as the one store in the DB for its profile. i have tried something like this but i dont get an echo:

$query2=mysql_query("SELECT emails_password,emails_id  FROM lala.in_emails  WHERE  emails_password ='md5($password)' AND emails_id='".$_COOKIE['LALA_ID']."'")or die(mysql_error());
if(mysql_num_rows($query2)>0){echo "same pass";}

so maybe the md5 algo always changes?

Answer 1

Check the query string by echoing to make sure that all vars are populated :

echo "SELECT emails_password, emails_id  FROM lala.in_emails  WHERE  emails_password ='".md5($password)."' AND emails_id='".$_COOKIE['LALA_ID']."'";

You shall get something like :

SELECT emails_password, emails_id FROM lala.in_emails WHERE emails_password ='098f6bcd4621d373cade4e832627b4f6' AND emails_id='some-emails-id'

Answer 2

Those single quotes (') around md5($password) should be removed. And no, MD5 hash does not change.

Answer 3

Your issue is Mysql syntax related, not hashes related.
Good practice would looks like this:

$password = md5($password.$global_salt.$_COOKIE['LALA_ID']);
$password = mysql_real_escape_string($password);
$lala_id  = mysql_real_escape_string($_COOKIE['LALA_ID']);
$query    = "SELECT emails_password,emails_id  FROM lala.in_emails  
             WHERE  emails_password ='$password' 
                AND emails_id='$lala_id'";
$result   = mysql_query($query) or trigger_error(mysql_error().$query);
if(mysql_num_rows($result)>0){echo "same pass";}

Thanks to Stephane and Imre L for their great comments, made this code better

Addendum: People in comments accused me for using escaping on MD5() function result.
I feel it's good point to be explained for the future readers:

If you think of data source of every particular variable - you're mixing layers.
MD5() do not do any "sanitization". It's just a coincidence that it's result contain no special characters. But one shouldn't think of this at all!
Database layer should be independent from context. It must be totally abstract. No matter how you validate your data - MD5, only latin letters, digits' etc - all this has nothing to do with database layer. DB layer should know noting of data source and form. It should just perform it's duty of making SQL of correct syntax. One day validation rule may change - for the plain password, or for some binary format may contain null byte, etc. Validation rules may change but database rules must remain the same.

Take prepared statements as an example:
Do you decide for the each variable, does it need binding or not? Nope - you're doing it unconditionally, for the every variable, no matter of it's form. So, escaping for the data in quotes should be.

Answer 4

1)escape $_COOKIE['LALA_ID'] with mysql_real_escape_string() to protect against SQL injections.

2)Use stronger version of hash, like sha512

3)If you so considered about protecting clients plain passwords then you could hash password in client side and send hash to server. On server hash it once again.