SHA salt in MySQL query

Question

I am setting a cookie. Something like:

$_COOKIE['test'] = SHA1('124'.'mysalt');

Now 124 is my id which I want. So in my MySQL table, I am trying to run a query like:

$sql = ("SELECT * FROM users WHERE SHA1(`id`) = '".mysql_real_escape_string($_COOKIE['test'])."'");

How to add the "mysalt" to the SQL query? Because else I want get the correct id.

Answer 1

Use can use Concat() for that.

SELECT ... Sha1( Concat(`id`, 'mysalt') )=...

Answer 2

The query should be:

$sql = ("SELECT * FROM users WHERE SHA1(CONCAT(`id`,`mysalt`)) = '".mysql_real_escape_string($_COOKIE['test'])."'");

if I understand correctly what you're trying to do.

Answer 3

The solutions already provided probably will work just fine, however are you certain you want to do this? If the field "id" is really a distinct identification you can use "LIMIT 1" to stop mysql from searching thru all your items. Another thing is, why don't you use a separate precomputed field for this? I mean in every query mysql unnecessarily needs to compute all these sha1 values.. One last thing. I'm uncertain why you are using your approach, but my best guess is to implement some sort of session key. I thing this is a bad idea for a couple of reasons: If someone gets holds on your salt, he has access to all your accounts. If someone sniffs one "session" he can reuse it whenever he wants to. Choosing a weak salt could have serious consequences. HTH.

Answer 4

Use CONCAT:

$sql = ("SELECT * FROM users WHERE SHA1(CONCAT(`id`,'mysalt')) = '".mysql_real_escape_string($_COOKIE[''test''])."'");