Insert into db using keys and MD5

**zorgi** · Dec 5 '11, 10:59 AM

If variables $k, $v and $salt are not defined somewhere in files you included than lines 19 & 20 make no seance. PHP needs to know exactly what those variables are to use them.

**Dormilich** · Dec 5 '11, 11:01 AM

firstly it is highly dangerous to uncheckedly take user input in your SQL query. anyone could write a form, post to your script and may execute whatever he likes on the DB (called SQL injection).

the other point is that you md5 the password, but you don’t use it, since it is outside the foreach loop.

**omerbutt** · Dec 5 '11, 12:53 PM

yup he's(Dormilich) right about it ,

Code:

foreach($_POST as $k => $v)

bu i think that along with it this must be also the cause as the salt value is already stored into $v and then in the for each the $v is actually the text input from the post array change this

Code:

 if( isset($_POST['Submit']) ) {
        $keys = "";
        $values = "";
        if($k=="password")
        $v=md5($v.$salt);
     
        foreach($_POST as $k => $v) {
          if( $k != "Submit" ) {
            if( $keys == "" ) $keys = "`".$k."`"; else $keys .= ", `".$k."`";
            if( $values == "" ) $values = "'".$v."'"; else $values .= ", '".$v."'";
     
          }
        }

to this

Code:

if( isset($_POST['Submit']) ) {
        $keys = "";
        $values = "";
        
     
        foreach($_POST as $k => $v) {
			if($k=="password")
	        $v=md5($v.$salt);
          if( $k != "Submit" ) {
            if( $keys == "" ) $keys = "`".$k."`"; else $keys .= ", `".$k."`";
            if( $values == "" ) $values = "'".$v."'"; else $values .= ", '".$v."'";
     
          }
        }

and what zorgi said is related to the cause too ($k, $v and $salt they need to be defined somewhere before)

regards,
Omer Aslam

**garwil03** · Dec 5 '11, 07:09 PM

Hi all.. thanks a ton for your time. Your solutions fixed my problem and after changing the code i ended up with what Omar has outlined and now everything is hunky dory... thanks once again to you all...
I have a lot to learn regarding MD5, some say it is not secure, some say I should be on SHA and yet others are saying I should use the built in PHP/MYSL features so I ahve a lot to read up on :)
Many thanks once again...

**omerbutt** · Dec 5 '11, 07:13 PM

Hey,
I am glad to be of some help o good luck with your R&D, please choose the correct answer so that others searching for the same problem might get some help too.
regards,

Omer Aslam

**Dormilich** · Dec 5 '11, 08:33 PM

I have a lot to learn regarding MD5, some say it is not secure, some say I should be on SHA and yet others are saying I should use the built in PHP/MYSL features so I ahve a lot to read up on :)

that’s right, MD5 can be exploited (i.e. you can relatively easily find a string with the same MD5 hash).

pretty much every other algorithm is more secure, probably the most common are SHA256+ and RIPEMD160+. the PHP function that handles that is hash() resp. hash_hmac() for salted hashing.

Insert into db using keys and MD5

Insert into db using keys and MD5

Comment

Comment

Comment

Comment

Comment

Comment