What kind of password begin with *9D87... in the database?

[matheussousuke]

I have a password like this

*9W0C5CB2A08313B8A04E63A80F1E6F01F3LK3876

on my database, I'm currenlty working on a script that changes the admin password and send it for the admin e-mail, but it changes to MD5, I tried to put sha-1, but even so, sha-1 also does not works. The password should begin with a asterisk "*", and it does not when I use SHA-1 or MD5.


The part of the code that does that is this one:

     //Generate a RANDOM MD5 Hash for a password
     $random_password=md5(uniqid(rand()));
 
     //Take the first 8 digits and use them as the password we intend to email the user
     $emailpassword=substr($random_password, 0, 8);
 
     //Encrypt $emailpassword in MD5 format for the database
     $newpassword = md5($emailpassword);
  // Make a safe query update administrator set sPassword = '$newpassword
            $query = sprintf("UPDATE administrator SET sPassword='$newpassword'",
                     mysql_real_escape_string($newpassword));
 
                     mysql_query($query)or die('Could not update members: ' . mysql_error());
 

Thank you

[dlite922]

That's a mysql generated password. see MySQL function PASSWORD().

Dan

[matheussousuke]

thx a lot, buddy. :-)

Really helped, I've been after this all daylong.


How can I apply it on the code above?

[dlite922]

use SHA-1. I believe Mysql.password() and md5() are already cracked.

Dan

[matheussousuke]

oh, I forgot to tell, that's the first time I'm messing with php forgot password script, I tried once, but could not make anything work.

I'm a php newby.

Yes, MD5 and that other are already cracked, but unfortunately there are more than 6 scripts on the sistem that use PASSWORD(), tried changing to MD5, SHA-1, could not help.



Is that the way to use PASSWORD() ???

 
 $query = sprintf("UPDATE administrator  PASSWORD=sPassword('$newpassword')",
                     mysql_real_escape_string($newpassword));
 
 
 

[matheussousuke]

I was reading here that PASSWORD() is not a function, so how does that work?

[matheussousuke]

u still there?

[Dormilich]

The password should begin with a asterisk "*", and it does not when I use SHA-1 or MD5.

neither hash algorithm outputs a *, only numbers (most of the time hexadecimal)

I was reading here that PASSWORD() is not a function, so how does that work?

MySQL PASSWORD() function

[matheussousuke]

Now I'm having an issue with the email verification.

I have another post with the same subject, forget about this one, go to: http://bytes.com/topic/php/answers/8...pt#post3611007


thx