Decoding a retrieved password from MySQL

[Markus]

Another day, another question. :)

I'm now onto building a login for my current project - image host.

User submits password > password is encoded
Like so:

        ('$username', PASSWORD('$password'), '$dispName', '$email')";
 

Now say, if i were to email them their password, (they've forgotten it?), it would send the encoded password and not the one they input! And i'm unsure of how to Decode it.

This is just soemthing i was using to see how i could decode it, this isnt the actual way i will go about it ;)

Obviously it doesn't work..

$query = "SELECT `ziprar_loginPass` FROM `ziprar_users` WHERE `ziprar_loginName` = 'markusn00b'";
$res = mysql_query($query);
while($row = mysql_fetch_array($res)){
    echo $row['PASSWORD(ziprar_loginPass)'];
}
 

Any ideas?

Thanks :)

[Atli]

Hi Markus.

You should never have to decode a password in your database. If a user forgets his/her password, you should rather generate a random password for them and send that to them via email, so they can log in and change it.

Nobody, including you, should be able to decode your user's passwords from the database. That is information only your users should be able to know. That is why we use hashing algorithms, because they can not be reversed (without major hacking) which makes them much harder to break than algorithms that can be reversed.

[Markus]

Hi Markus.

You should never have to decode a password in your database. If a user forgets his/her password, you should rather generate a random password for them and send that to them via email, so they can log in and change it.

Nobody, including you, should be able to decode your user's passwords from the database. That is information only your users should be able to know. That is why we use hashing algorithms, because they can not be reversed (without major hacking) which makes them much harder to break than algorithms that can be reversed.

Hmm... but then surely i'd have to update the password on their request without clarifying that they are indeed the actual user of that email address...

If you understand me?

Oh wait, no i see!

I'd just send an email to have the user confirm that they did request their password to be reset!

Thanks!

[Atli]

This is true. But you could, for example, send them a link to a 'change password' page on which, the newly generated password would work, while the old one would still be valid using the normal login procedures.

That way, even if some prankster is going around reporting missing passwords for users he doesn't own, nobody is required to change their password, they only get an email saying that somebody reported that they had forgotten their password, which they could ignore.

And if you are getting frequent false reports of lost passwords, record the IP address of the people sending the reports and block them.

[Markus]

Noted!

Thanks a bunch :)

[Atli]

Glad I could help :)