AdSense

Tuesday 28 May 2013

PHP - Save password as hash and not as plain text

(Deutsche Version) Currently, I am working on a text based online Game. For the login sequence, it is necessary to save the user passwords. The basic idea is simple: The password is saved into a file on the server which is not accessible from the internet. The problem is: What would be if a user was using his password for everything, e.g. for banking accounts? I would be able to look at the password. Therefore, passwords should not be saved as plain text.


The solution for this problem is the usage of a hash-function (http://en.wikipedia.org/wiki/Hash_function). The implementation in PHP is the following:

$passwort = hash('ripemd160', $passwort);

hash returns a combination of numbers and letters. This combination is (with a relatively high propability) unique. In the PHP code the password is directly converted into the hash value, all operations which need the password are performed with the hast value (e.g. password saving, comparison if the password is valid). From this hash value, it is not possible to generate the password, because the hash value would be converted again if someone (evil) would type in the hash value which would result in a totally different value. It is impossible to find out the password or crack it because it is not saved anywhere.

No comments:

Post a Comment