php and sha1

• login form
• if (CheckLogin($nickname, $password) == "true"){$_SESSION['LoggedIn'] = "true";} else {$_SESSION['LoggedIn'] = "false";}
• function checklogin
• function memberinfo
• password put into databse

I'm making a login form, and running into some problems checking the encrypted password from the login form to the password that is stored in the database. The pages being affected are bellow.

¶login form

$nickname = $_REQUEST['nickname']; $password = $_REQUEST['password'];

¶if (CheckLogin($nickname, $password) == "true"){ $_SESSION['LoggedIn'] = "true"; } else { $_SESSION['LoggedIn'] = "false"; }

¶function checklogin

	function CheckLogin($nickname, $password){
		$salt = MemberInfo("Salt", "WHERE Nickname = '$nickname'");
		$pass = sha1($salt.$password);
		$sql = mysql_query("SELECT * FROM member WHERE Nickname = '$nickname' AND Password = '$pass'");

		if ($sql === true){
			return "true";
		} else {
			return "false";
		}		
	}

¶function memberinfo

works fine, pulls correct information

¶password put into databse

$password = sha1($salt.$adminConfig['password']);

$adminConfig['password'] and $password (on page 1) are the same value

The problem is that $pass (from checkLogin function) and $password (from the password inserted into the database) are not the same.

Any ideas what would be causing this?

I just tried it without the salt, and it is still not working.

sha1($adminConfig['password']) != sha1($pass)

even though the values for $adminConfig['password'] and $pass are the same… ugh.

Just use the MySQL SHA1() function in the WHERE portion of your query instead of using the PHP one (on your $pass variable). Why would it make a difference? No idea… maybe a default salt of some sort.

I may be wrong, But is it supposed to have 3 equal signs?

Feralas wrote: if ($sql === true){

It doesn't have to have 3 equal signs, but the syntax is valid and shouldn't make a difference.

Oh, ok wasn't sure. Haven't ever seen 3 before.

http://us3.php.net/operators.comparison

I figured it out.

My salt function was making a salt of 51chars, instead of 50 (I started at 0, instead of 1) and the database was only storing 50chars.

I hate dumb mistakes lol.