Encrypting sensitive data
 

I'm developing a website in php with a MySql database. The website has a login page that reads the user data from localdb.logins where localdb is my database. Although I'm only developing the site to learn PHP, I like to get into good practices so I was wondering, how do you go about encrypting the username and password fields IN THE DATABASE?

Currently, here's the schema for the logins table:

You should encode the password in the database using MD5, it's easy - just insert the value with MD5( before and a ) after ;). The clientside should encrypt the password as well, also with MD5 (there are some nice javascripts on the internet), and send it as a form. You compare then the hashed passwords.
You could do the same with the username - but it's not necessary.

Hope this helps :)

Try this to encrypt the password entry of new users:

INSERT INTO logins (username,password) VALUES ('billybob',PASSWORD('mypasswd'));

if you want something better than MD5 php will need mcrypt support compiled in. Take a look at the mcrypt functions on the php website.

http://ca3.php.net/manual/en/ref.mcrypt.php


mcrypt supports: DES, TripleDES, Blowfish (default), 3-WAY, SAFER-SK64, SAFER-SK128, TWOFISH, TEA, RC2 and GOST in CBC, OFB, CFB and ECB cipher modes.

it also supports some ciphers that are not free (free as in beer) as well, but i don't think you'd be using them.

I recommend starting with MD5, when it works you can also switch to a better way of encrypting :)

MD5 is the easiest way to go for passwords. Which is all you really need to do besides mabey e-mails(don't want spammers getting your memebers e-mails) but for that you will need mycrypt which is a bit confusing when your start but one you get the hang of it it's simple.

i found mcrypt pretty easy to use.

Thanks for the help guys. For now, I'll go with the easy stuff. But if I ever go public with the website, I will use mcrypt and encrypt the password on the client-side as well.

EDIT: Just a note, PASSWORD() seems to be better than MD5() and just as easy:
MD5('cheaito') = 3aff9b940d4a940cfad131e6bbde779a
PASSWORD('cheaito') = *0DBF924D6D6CB7167F217C55F29FF9F875406960

:confused:
BTW that's not my actual password. :D

Like polyphemus_ said, start with MD5. It's what I use. If you're really paranoid, though, you can always do SHA-1 or generate longer hashes. Try taking the hash of a small section of the pass in addition to the hash of the original:
That's slower and whatnot, but if you're paranoid, it's much more secure.

PASSWORD looks idd better than MD5, but I'm not sure there are javascripts around on the internet to encode the password the same way.