mysql - Password holding different data (phpMyAdmin Database) -
password varchar(120)
above column name
, datatype
password set. using phpmyadmin database , created user testing purpose usertest username , user123 password. when checked database, instead of holding user123 password, holds 0dcbd056919392554f346a10cc114d27. compared sql server database, sql server database hold exact data password user entered through registration.
even so, still can login using user123 password username usertest. if used 0dcbd056919392554f346a10cc114d27 password, unable login system. i've notice , started wonder, admin, how going know user password 1 used register, if going through database?
why on earth need know user's password? awful idea. explicitly don't want know user's passwords, or have means decrypt them. there many reasons why bad idea, 1 of them if user re-uses passwords , database compromised, user's plaintext password has been compromised.
what more common hash password; taking user's password, combined cryptographic salt, , enter input hash function (i believe bcrypt common these days, requirements may vary). function returns nonsense string $2a$06$xkjbhsfb4q53movnjrgeuokqkpnoipjfq7p8qmuwa63qgehnplymu store in database. when user tries log in, repeat hash process , compare result value stored in database.
if have business need store plaintext password, highly recommend warning users in plain language database going stored insecure means , absolutely use specially-crafted password application.
again, recommend not storing passwords in plain text , making sure have cryptographically secure hash in place.
but anyway, directly answer question, you're not storing plain text value here. can't know you're doing when you're inserting user's password, you're performing function on varchar field. you've selected 1 of functions dropdown in phpmyadmin insert page (see screenshot below); applies selected mysql function data insert it. there's not reason phpmyadmin mangling data this, seems likely.
Comments
Post a Comment