Difference between revisions of "PHP-and-MySQL/C4/MD5-Encryption/English-timed"

|Hello.  If your concerned about php security, then this tutorial will take you through the MD5 function.

|Its a predefined function that converts a string to a MD5 hash and allows you to secure your data.

|The MD5 hash uses a one way out rhythm so it cannot be decrypted - it can only be encrypted.

|The only way to find out an MD5 hash is to convert a string to an MD5 hash as well and compare it to a string that has already been converted to a hash.

|If you don't know what i mean I'll be going through it in this tutorial.

|I'll start by predefining a string that's going to be my password.

|I'll call it 'user password' and that will have the value 'abc'.

|Next I'll create a new variable called 'user password e n c' which stands for encryption and I'll define my MD5 functions, which is basically m,d and 5.

|Anything can go in here so you can give anything that you want to encrypt in here  

|But for now I'll encrypt my user password variable that we defined up here.

|And if we just echo this out, you can see that we get our....,  

|our value of our MD5 encrypted script which is this.

|You can see that it starts with nine hundred and I think there are around 20 common characters here

|So we have an encrypted string whereby the hash you see here is equal to 'abc'.

|We can do a simple check to say if the post password is equal to our user password then do something otherwise do something else.

|So for example you can have an error saying 'incorrect password' and here you can say 'your password has successfully matched the user password'.

|But when we are taking into account data that we are either having in post variables or are contained in the data base,...

|This value may have been instructed from the data base and data bases can be broken into unfortunately.

|Therefore if a data base can be broken into you will want every password belonging to your users to be encrypted,  so that they are much harder to find.

|By converting 'abc' to a MD5 hash you can compare it to a MD5 hash already stored in your data base and if these two hashes match then they'll know that the MD5 hash equals 'abc', as they had already hashed just to start with.

|Anyway what we'll do is we'll be taking this value here - our user password encrypted - and we'll compare our posted password to our encrypted password.

|Now what we actually need to do is to be able to compare 'user password enc'

|This as it stands is encrypted and this posted password as it stands is not encrypted.

|So if you take the MD5 hash of the posted password and compare that to the MD5 hash of the stored password, we can let our user know if they've entered the correct or right password.

|So I'll say if the MD5 hash of a posted password is equal to the MD5 hash of the stored password, which is here, this is the variable we're using here, then we can display the correct message or we can display an error message.

|And if they do match then I'll say clear this script and write 'correct' otherwise I'll just kill the script and say 'incorrect'.

|At the moment we can't compare these because we haven't posted any variables

|Down here I'll create a form.

|Method is also going to be POST because we're using the post method up here

|And the action is going to be my page that is currently on which is 'MD5 dot php'.

|Next I'll just create two elements of this which is an input text box and I'll give the name of password.

|The only reason I'm using this as type text is so you can see the content otherwise you can give it a password to blank out the characters.

|Next, I'll have an input box and this will say, lets just say log in for now because this is a typical use for an MD5 encryption which would be a log-in script.

|When I refresh my page you can see 'incorrect' at the moment.

|That's because we're not checking for our post variable.

|Here i could just say if password exists then we can echo out all this code and we can indent this to make it more readable.   Let me get this back here.

|Okay so if our password has been submitted,which means this form has been submitted with this value then we are saying "Does the MD5 hash of the encrypted password that is the password entered in the form, which is our post variable over here, equal the hash of the password stored?"

|So we're dealing with encrypted data in this if statement here.

|If it is matching then we can display this otherwise we can display 'incorrect'.  So lets refresh that again.

|Now my password is 'abc' so if I type 'Alex' as my password, you can see we get an 'incorrect' error message.

|If we type 'abc' as our password, which is correct, you can see we get a 'correct' message  

|Just to give you an idea of the content what I can do here is I can say echo and I can say 'compared' and lets take our user password - in fact, NO - lets take our encrypted password.

|So compare 'user password enc' to - I'll just concatenate on that and the posted password

|We want all of it to be encrypted so here I'll type MD5.

|The best way to do this is to create a new variable up here saying, MD5 - cut this - so 'enc' or 'submitted enc' equals that.

|Then we can just replace our variables in here so it makes it a bit more....,a bit more fluent.

|But here when we choose 'abc' and we click log in and we have got an error.

|Lets come back and check.....  and it's because we need to put these in curly brackets since we've got two lines of code here.

|Lets go back, click back, choose 'abc' and we are comparing this here to this here.

|Lets just beak it up here so we can see  whats going on.

|Okay so we've compared this here to this here.

|You can see they're exactly the same MD5 hash, however this here is the stored password and this is the password that we've submitted.

|So you can see that we're checking our submitted encrypted to our stored encrypted.

|This has many uses, you can use it in data bases when you are registering a user in a data base, encrypt the password then store it.  

|If your checking in a log in form for a password, encrypt the password the users entered in the log in form and check that to the encrypted password at the data base.

|So you can see that this has lots if uses and it's really easy to declare.  You just need have an MD5 function here.

|That's all you really need to know now on MD functions and how to use them and how to apply them to your forms.

|Okay thanks for watching.

|I have some other security tutorials that are coming up so look out for those.  Bye.  

|This is Joshua Mathew dubbing for the Spoken Tutorial Project.