Geen fout

Toon records

SELECT *, LENGTH( pw_encrypted), LENGTH( pw_hash_encrypted) FROM forum WHERE id = 1;

stdClass Object
(
    [id] => 1
    [username] => Harald
    [password] => Wachtwoord
    [enc_key] => 9ZVW349YOE45PS7
    [pw_hash] => $2y$10$6/5oAbQCh05QFGNavWE1eOrC/kjIPSwxr8gB0HoE/NirgNI9UpZse
    [pw_encrypted] => 0009E5F2A061696F9F8291E0A5652FC2
    [pw_hash_encrypted] => 88453CED53D5C0354631C394562BBD6DBEE0DCEA637B2F129365BA6BE79441E525C71CA96CA04971DD9C870BF0CF6F6CAC152904AA463DB4D0A42AFC4D3846F1
    [enc_pw_encrypted] => 1436A7584C9E908CCC6A44A501D096B8
    [enc_pw_hash_encrypted] => A5D257482E448B2108ABC556C336FC3D7ADD404264AF8C36AEE2DD6B3F87FE9C2EA5E978A2DBD1E1170417CF1ADA5C11752C940D93DF0ACEC25C15D799A465AA
    [LENGTH( pw_encrypted)] => 32
    [LENGTH( pw_hash_encrypted)] => 128
)

Toon records NA UPDATE

In plaats van het password kan ook de hash van het wachtwoord worden encrypt.

In werkelijkheid wordt het wachtwoord NIET leesbaar bewaard.

In het geval de database wordt gejat, moet eerst de encrypted hash worden decrypt alvorens de hash zelf kan worden gekraakt.

De $SQL_encrypt_key variable moet op een veilige plek worden bewaard. De meningen verschillen over waar die veilige plek dan wel is.

Het encrypten/decrypten gebeurt door/op de MySQL/MariaDB databaseserver volgens onderstaande link.

➠ https://mariadb.com/kb/en/aes_encrypt/

➠ De toelichting voor het geval dat u ’m gemist heeft.

➠ Download dit PHP bestand

User specific enc_key = P6RF4KKTH4693KD

$query = "UPDATE forum SET pw_hash = '" . $pw_hash . "', pw_encrypted = HEX( AES_ENCRYPT( password, '" . $SQL_encrypt_key . "' ) ), pw_hash_encrypted = HEX( AES_ENCRYPT( pw_hash, '" . $SQL_encrypt_key . "' ) ) WHERE username <> '';";

UPDATE forum SET pw_hash = "$2y$10$WDmz2lusqP.zGY5RGKlMROgaFYPIQxnHD4Bc2Y86o6fj04FKMlsVO", enc_key = "P6RF4KKTH4693KD", pw_encrypted = HEX( AES_ENCRYPT( password, "Carthago moet vernietigd worden" ) ), pw_hash_encrypted = HEX( AES_ENCRYPT( pw_hash, "Carthago moet vernietigd worden" ) ), enc_pw_encrypted = HEX( AES_ENCRYPT( password, "P6RF4KKTH4693KD" ) ), enc_pw_hash_encrypted = HEX( AES_ENCRYPT( pw_hash, "P6RF4KKTH4693KD" ) ) WHERE id = 1;

Parse encrypted

Form Input With Encryption
Field Value
ID1
UsernameHarald
passwordWachtwoord
hash$2y$10$WDmz2lusqP.zGY5RGKlMROgaFYPIQxnHD4Bc2Y86o6fj04FKMlsVO
enc_keyP6RF4KKTH4693KD
 
pw_encrypted0009E5F2A061696F9F8291E0A5652FC2
pw_decryptedWachtwoord
pw_hash_encryptedB3519452ACEF6D8435E2BD8C0BB768BD9A10AAA0C2C78D2A0108CBE537B9BBC5E51B0FD055C949C9FE9AF482DBF51F631D65B46499DE0E66806656208991E9B3
pw_hash_decrypted$2y$10$WDmz2lusqP.zGY5RGKlMROgaFYPIQxnHD4Bc2Y86o6fj04FKMlsVO
 
password is Valid
 
enc_keyP6RF4KKTH4693KD
enc_pw_encrypted8101E55728672F4CA985E549ACA2B876
enc_pw_hash_encryptedC9629DA2CEC99D4415AD06206E65E4EE9D91ECCCE5EA80C7777816B9D35CFDEBD73CADEAB3F5CEEFE7EDF5790DA8909716F8263CF1B2EB1B27C54B6481F0B3B2
enc_pw_decryptedWachtwoord
enc_pw_hash_decrypted$2y$10$WDmz2lusqP.zGY5RGKlMROgaFYPIQxnHD4Bc2Y86o6fj04FKMlsVO
 
password is Valid