Servage Magazine

Information about YOUR hosting company – where we give you a clear picture of what we think and do!

Secure password storage with PHP and MySQL

Thursday, August 2nd, 2012 by Servage

Every web developer knows what the user data is the most important data he administrates. The user data is the base for logins, authenticating sessions to be a specific person, thus authorizing them to perform certain actions. If the authenticated session isn’t by the person you expect, then you risk authorizing wrong people to actions you’d never want them to do. You could argue that this is usually the users problem, but actually it is yours just as much. The inconvenience, problems, bad reviews, or whatever might be the result of compromised security, is something you really don’t want. It could break your business. Therefore having a proper and secure password storage is one the main keys to good security. Of course one thing alone can never the entire security setup, but every part should be optimized as much as possible.

This article will describe a secure password concept, and how to implement it. Please beare in mind, that no thing is ever secure forever, for example encryption considered secure 10 years ago, can be cracked quickly today. So staying updated is key to long term security. The following recommendations are based on todays possibilites.

What is a secure password concept

The first rule, the whole grail of password storage concepts, is to never store the password in a reversible format. This is probably the most common, most risky and most stupid mistake to make. You don’t need to be able to reverse the password. Never. It’s also bad for users who might be using the same password accross multiple sites. So just don’t do it! Instead, encrypt the password using strong encryption, and add both site-weide and user-specific content to the encryption string. Thereby you make the encrypted password (so called hash) more hard to decrypt.

The main concept is that you take the users desired password, add some specific string (the same for all users), and add another string (unique for all users). This combination is then strongly encoded, for example using SHA 512bit, and the result stored in your database. This will result in a 128 characters long string, which should be pretty damn hard to decrypt, even if someone manages to steal your entire user database.

When someone loggs in, you take the provided password and perform the same encryption. You then compare the encrypted string with the stored string. If they match, then the proper password was entered. If not, then the password is invalid. This method allows you to check logins, secure the password on a per user basis – and not run the risk of easily reversible passwords.

How to implement a secure password concept

In PHP you would have a string like this:

$string = md5( $password . $applicationWideString);

In MySQL you could then query against the stored values like this:

SELECT FROM users WHERE username = '$username' AND password = SHA2( CONCAT(salt, '$string'), 512)

You can use the same principle when inserting the password. The $string in the SQL is the same as $string in the above PHP code example.

This will effectively give you a password mechanism which is using both secure encryption and random obfuscation. The ‘salt’ value in the SQL query above is a field called ‘salt’t which contains a random value for each user. You should generate that random value when you add your user to the database.


Secure password storage with PHP and MySQL, 3.8 out of 5 based on 5 ratings
Categories: Guides & Tutorials

Keywords: , ,

You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

No comments yet (leave a comment)

You are welcome to initiate a conversation about this blog entry.

Leave a comment

You must be logged in to post a comment.