Password Hashing - FMWebschool

Password Hashing
By: Alex Babkov
Introduction / Disclaimer
This article will take a look at the basics of password hashing, and provide an overview of what it is,
how it’s used and why it’s used. This article is only designed to act as in introduction to the subject
and at worst to add some security to databases that currently utilize plain text storage of critical user
login details. If you are interested in fully securing your database it is recommended that you read
further on the subject and look in detail at the MCrypt and MHash extensions for php.
What is a hash
Simply speaking, a hash [value] is a unique fixed length string, representing another variable length
string, which is generated using a particular hash function (e.g. MD5, Sha1 etc). Hashes rank on a
scale of hard to impossible to invert and as a result often serve as a method of 1 way encryption of
data (though this is not their only use).
Password Hashes
When the user generates an account, a hash of their password (rather than their actual plain text
password) is stored in the password field of the database record. Every time they log into the
system, an identical hash is run on the password they submit prior to performing a search.
For Example:
1) Account Creation:
Password Submitted: apple
Password stored in database: d0be2dc421be4fcd0172e5afceea3970e2f3d940
2) Login:
Password Submitted: apple
Password used in search: d0be2dc421be4fcd0172e5afceea3970e2f3d940
Why hash passwords
People will generally tend to re‐use passwords between websites / online services. If someone was
to gain direct access to the data in your database and hashing had not been utilized in its
authentication system, the thief would have immediate access to a large collection of user names
and passwords that they would be able to try against a large number of online services ranging from
forums to bank accounts – or alternatively just to the online service you are providing.
Hashing with PHP
PHP provides a number of native hashing functions. Each function has its advantages and
disadvantages. Because this is just an introductory article, we’re not going to go into these
advantages and drawback of the various functions available and will just rely on the fact that sha1 is
a good, common hash function available with all recent php installations.

All one has to do in PHP to hash a string is to run the sha1 function on it, for example:
setField(‘username’,$username);
$add->setField(‘password’,$password);
$add_result = $add->execute();
Account Login Sample

wild card characters here using regex. E.g. @ should be escaped to \@)
$username = $_REQUEST[‘username’];
//create the password hash.
$password = sha1($_REQUEST[‘password’]);
//construct a find command and submit the hashed password for storage to the
accounts table
$find = $fmdb->newFindCommand(‘accountsLayoutName’);
$find->addFindCriterion(‘username’,$username);
// Note that the sha1 hash is an alphanumeric hash meaning that all
wildcards will be rendered inoperable.
$find->addFindCriterion(‘password’,$password);
$find_result = $add->execute();
if( !FileMaker::isError($find_result) ) {
//User logged in successfully, set session up and take them wherever
they are meant to go
} else {
//Authentication failed. Display an error message to the user
}