I've recently started to learn PHP, and was trying to create a secure Login following this guide http://www.wikihow.com/Create-a-Secure-Login-Script-in-PHP-and-MySQL.
Everything seems to work fine for me apart from the login(). Which I tweaked a bit.
I put some echos to try to pin point the error, it returns an error on the password compare IF:
The function returns : Login function error 1
The function login located in includes/functions.php :
$password = hash('sha512', $password . $salt);
if ($db_password == $password) {
echo "Password is correct!";
The sha512.js is from here pajhome.org. uk/crypt/md5/sha512 .html,
and the form from the above mentioned WikiHow.
The connection isn't a problem has i use the same connection to insert into MySQL and it works.
Thanks for the attention given to my problem and if i didn't disclose enough info please advice.
EDIT: deleted a lot of code, as @SeanWM commented i shouldn't expect no one to go through all the code.
@Robert Rozas Thank you for the help. the passwords are indeed mismatching.
The output is:
Login function error 1 c2d872cb4c6a1b3c22ce35fb9dc0dfca14aa6d48 vs c2d872cb4c6a1b3c22ce35fb9dc0dfca14aa6d48cc2e8c3dcf02c87a3dfb7e3fec2a098b932c11655960e43bb89af058220ff8d75c666fe57ef7206b74d5f9af
Please have a look at how the password is constructed:
It goes from the register form to .js:
// Add the new element to our form.
form.appendChild(p);
p.name = "p";
p.type = "hidden";
p.value = hex_sha512(password.value);
and then through php:
$password = filter_input(INPUT_POST, 'p', FILTER_SANITIZE_STRING);
// Create a random salt
$random_salt = hash('sha512', uniqid(openssl_random_pseudo_bytes(16), TRUE));
// Create salted password
$password = hash('sha512', $password . $random_salt);
and then inserted into MySQL. If you could please point me again in the correct direction i would appreciate.
EDIT 2: Thanks to the input from @Second Rikudo it worked after removing the double hashing
But in light of the comments from Second Rikudo "sha512 is not secure"
and @tadman "That tutorial is worryingly incomplete and uses hazardously bad practices"
I've decided to revise the code utilizing https://github.com/ircmaxell/password_compat
as advised by Second Rikudo.