Encryption Techniques for Your PHP Development

[next]

Recently, an attacker hacked into my database and stole all the passwords and usernames stored there. Needless to say, I had to change everything and it cost me time and money. What made the crime easy for the attacker is that I never encrypted any of the passwords in the database. I've learned my lesson and now I'm passing along that wisdom with this article about encryption in PHP. Using some of the encryption techniques that PHP offers, you can safeguard your information in various ways.

One-way Encryption

Very few databases offer data encryption, so the developer must encrypt passwords before sending them to the database. One-way encryption is perhaps the safest way of storing and protecting passwords, and it is very widely used in the computer world. One-way encryption means that a password gets encrypted and cannot be decrypted again. So you have to remember the password, because you will not be able to recover it.

Every encryption method uses an algorithm, basically a blueprint of how the encryption works. Algorithms that achieve one-way encryption are called hashing algorithms, and they work by taking a string (for example, JohnDoe) and then creating a unique fingerprint (if you like) from it. PHP offers a hashing algorithm called MD5, which basically takes a string and returns a 128-bit fingerprint of it. To my knowledge, the MD5 algorithm has not been broken yet, because it would take a long time and some formidable computing power. Also, creating two inputs (or more) with the same fingerprints is would be very difficult.

Don't get me wrong, hashing algorithms are not 100% secure. They are subject to brute force attacks and as with any other algorithm can be broken given enough time and effort. Also, the length of time it takes to break a hashing algorithm is dependent on the complexity of the algorithm itself. Shorter passwords won't take very long to break.

I currently use the MD5 algorithm to protect my passwords, mostly because the original string (password) can never be recovered from the resulting fingerprint but we can hash the password when a user logs in and then compare the two.

Let's build a small login site to test the MD5. Use the following code to create a form that takes a password:

When the form sends the password, the code below takes it and turns it into a 32-character hash. Say we entered "HageGeingob" as the password; it would give us the following hash:

What I like about this hashing algorithm (and what makes it particularly useful) is that you can use the hash to compare it with the original password. So no one other than the owner of the password would know the password. This is how we compare the hash with the original password, which should also be hashed. Change the previous form to this:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "https://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>Untitled Document</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css">

</style>
</head>
<body>
<form action="login.php" method="post">
<table width="100%"  border="1">
  <tr>
    <td colspan="2"><span class="style1">My Diary </span></td>
  </tr>
  <tr>
    <td width="14%"> </td>
    <td width="86%"> </td>
  </tr>
  <tr>
    <td>Login:</td>
    <td><input type="password" name="pw"></td>
  </tr>
  <tr>
    <td>Enter HASH </td>
    <td><input name="hash" type="text" id="hash" size="40" maxlength="40">
      <input name="hsh" type="submit" id="hsh" value="Submit"></td>
  </tr>
  <tr>
    <td> </td>
    <td><input type="submit" name="submit" value="submit"></td>
  </tr>
</table>
</form>
<?php if(isset($_POST['submit'])){
$npass = MD5($_POST['pw']);
echo "Here is the fingerprint of your password which is <br>";
echo  "<b>Password:<b> ".$_POST['pw']."  <b>Hash:</b> ".$npass;
}
if(isset($_POST['hsh'])){
if(md5($_POST['hash'])=='df3eae2586ed7f3762b4131d08b11bf0'){
echo "The passwords match";
}else{
echo "The passwords do not match";
}
}
?>
</body>
</html>

Now enter the password that we entered before in the field that says "Enter Hash" and press the submit button next to it. You should get a result that says "Passwords match". So, how exactly did we compare the passwords? We hashed the fingerprint of the password called "HageGeingob" and then compared it to the hash value that we received previously:

Then we simply print out the results.

Another one-way encryption function that is fully supported by PHP is the SHA1() function. It works in the same way as MD5, but it produces a slightly longer hash. Let's modify our login form to accommodate the SHA1() function:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "https://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>Untitled Document</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css">

</style>
</head>
<body>
<form action="login.php" method="post">
<table width="100%"  border="1">
  <tr>
    <td colspan="2"><span class="style1">My Diary </span></td>
  </tr>
  <tr>
    <td width="14%"> </td>
    <td width="86%"> </td>
  </tr>
  <tr>
    <td>Login:</td>
    <td><input type="password" name="pw"></td>
  </tr>
  <tr>
    <td>Enter HASH </td>
    <td><input name="hash" type="text" id="hash" size="40" maxlength="40">
      <input name="hsh" type="submit" id="hsh" value="Submit"></td>
  </tr>
  <tr>
    <td> </td>
    <td><input type="submit" name="submit" value="submit"></td>
  </tr>
</table>
</form>
<?php if(isset($_POST['submit'])){
$npass = SHA1($_POST['pw']);
echo "Here is the fingerprint of your password which is <br>";
echo  "<b>Password:<b> ".$_POST['pw']."  <b>Hash:</b> ".$npass;
}
if(isset($_POST['hsh'])){
if(SHA1 ($_POST['hash'])=='df3eae2586ed7f3762b4131d08b11bf0'){
echo "The passwords match";
}else{
echo "The passwords do not match";
}
}
?>
</body>
</html>

[next]

Encryption Techniques for Your PHP Development

One-way Encryption

Find a programming school near you