Hashing in phpMyAdmin

Question

I have a mySQL database and I use phpMyAdmin to access it. The database has table employees with fields such as name, address, email address and password.

Initially, the password field was just VARCHAR (20) . But now I want to hash my password using SHA-256 hash technology.

I do not have much experience with databases, so I want to know -

• Can I use all my current employee passwords without affecting other fields or the entire table?

• In the future, when I enter data into a database (from a web application), where can I write a hash function for password hashing? that is, hashing occurs at the front end, and then the hashed password is stored in the database or the password goes to the database, where it is hashed and then saved.

Solution and suggestions are welcome.

Answer 1

Q1: Can I use all my current employee passwords without affecting other fields or the entire table?

A: Yes. But you need to resize the password column to 40-42. You will use the built-in PASSWORD( ) function to encrypt your password.

 ALTER TABLE tableName MODIFY `password` VARCHAR(42); 

after that you can now update the password column

 UPDATE tablename SET `password` = PASSWORD(`password`); 

ex.)

 abcde12345 => *20B30AFAF441808B50273EDA287132EC25B02DE2 

Q2: In the future, when I enter data into a database (from a web application), where can I write a hash function for hashing a password?

A: In an INSERT query

 INSERT INTO tableName (name, address, email, password) VALUES ('aa','bb',''cc,PASSWORD('abcde12345')) 

when you want to find the password, first encrypt the text:

 SELECT * FROM tableName WHERE `password` = PASSWORD('abcde12345') 

one more thing, be sure to avoid the Password column with the backtick , since this is a MySQL reserved word.

Answer 2

You can enter the password in php and then save it in the database:

 $pwd = hash('sha256',$_POST['password']); 

MySQL does not support the sha256 function, so you need to hash the code and then save / update the password table. Otherwise, you can consider this http://stuge.se/mysql-sha256/

Answer 3

Can I use all my current employee passwords without affecting other fields or the entire table?

Yes. For example, if you intend to use the SHA-1 hash function, you can add the corresponding column and hash of all your passwords with a single request:

 alter table employee add column password_hash varchar(40); update employee set password_hash = sha1(password); 

It is assumed that your column with a plain text password is called “password”. Of course, you can delete the original column after you have the hashes (and most likely this is exactly what you want to do next).

However, I highly recommend that you read the hash algorithms in more detail and choose something better. For example, you can use another hash function and / or add salt .

In the future, when I enter data into a database (from the Internet application), where do I write a hashing function for hashing a password? those. whether hashing occurs at the front end, and then the hashed password is stored in the database or the password goes to the database where it is hashed and then saved.

Most often, hashing occurs on the server side each time a user logs in. Then an authentication session is created and the session identifier is stored in user cookies (therefore, you never store the password or its hash on the client side, however, you pass it to the server when the user logs in, which is why it is useful to use SSL, at least , for authentication).

In some cases, you can even create a separate authentication server that only accepts password hashing requests (therefore, even if someone cracked into your system, the exact hashing scheme will still be secret until they crack the hash, which can be much more difficult if you build it carefully enough). However, you only need something like this if you really care about security, and this is really important. Otherwise, normal server-side hashing will suffice.