sha('$password') return with empty set

Question

I have two problems. problem one: I am trying to create a registeration form where users can register with my website. when I run this mysql statement a get dublicate entry found error:

$sql "insert into users(username, password) values('$username, sha('$password'))";

Duplicate entry 'da39a3ee5e6b4b0d3255bfef95601890afd80709' for key 'password' despite the fact that I changed the the string sha('$password') several times. please help.

else{
   include("databaseconnection.php");
   $databaseconnect = connect($host,$user,$password,$database)
      or die("couldnot connect to database serever.\n");
   $database_select = mysql_select_db($database,$databaseconnect)
      or die("could not select dabases.\n " .mysql_error());
   $query2 = "insert into company(username,password)
      values('$username',sha1('$password'))";
   $result2 = mysql_query($query2,$databaseconnect);
   echo "you have been registered as '$companyloginName' <br/>";
   header("Location:/index.php");

my login php script is as follow:

   $result ="select username, password form users where username ='$username' and password = sha('$password');
    if(mysql_num_rows($reuslt)==1){
   echo"welcome '$username";
    }

Answer 1

First, I would STRONGLY advice against using MySQL's sha() or PHP's sha1() alone for password hashing purposes. This is a huge security risk for your users if your database gets compromised.

Please take the time to read my previous answer on the subject of password hashing to properly secure your data.

---

Second, your code is vulnerable to an SQL Injection attack. Use mysql_real_escape_string() to escape the variables you are going to put in your query before-hand.

$query2 = "insert into company(username,password)
  values('" . mysql_real_escape_string($username) .
          "', sha1('" . mysql_real_escape_string($password) . "'))";

---

Third, your $password variable is being overwritten by your databaseconnection.php file.

include("databaseconnection.php");
$databaseconnect = connect($host,$user, $password ,$database);

To put emphasis...

$databaseconnect = connect($host,$user,$password,$database);

Therefore, the $password used later on in your query still contains the password for the database connection, not your user's password.

Change the name of your variable in databaseconnection.php or even better still, use an array to hold all the configuration.

$dbConnectParams = array('host' => 'localhost'
                         'user' => 'myUser',
                         'pass' => 'myPassword',
                         'db' => 'myDB');

Then, change your code as follows:

include("databaseconnection.php");
$databaseconnect = mysql_connect($dbConnectParams['host'],
                           $dbConnectParams['user'],
                           $dbConnectParams['pass'],
                           $dbConnectParams['db']);

Since you are already passing the database when calling mysql_connect(), you do no need to call mysql_select_db().

Answer 2

da39a3ee5e6b4b0d3255bfef95601890afd80709 is the sha1 hash of the empty string. Make sure that you actually insert the password into your SQL query, for example by echoing the query instead of sending it to the SQL server.

Edit With the new information added to your question, check out these two lines:

include("databaseconnection.php");
$databaseconnect = connect($host,$user,$password,$database)

Here, $password is the password used to connect to the database. The inclusion of databaseconnection.php probably overwrites what was previously in the $password variable.

Try to echo $query2 and you'll probably see it for yourself, that the SQL query doesn't include any password at all or that the password therein is not the same as the one entered by the user.

Answer 3

Guessing from the commented line, it may be possible you accidentally use the connection password that is set in 'databaseconnection.php' rather than the user password - you don't show how you initialize the $password string.

Also note the comma in your sql that shouldn't be there:

insert into company(username,password,)
                                     ^

I have not tested if that is the cause, but you should probably get rid of it and test it again.

Also, seriously consider pdo / prepared statements to prevent sql-injections, even more so if you want to insert the password from user input.