Why is the PHP crypt() function returning the same thing for two different strings?

Viewed 1398

I'm using PHP's crypt function for password hashing/encryption, but I don't think I am doing it right because "nathan12" and "nathan123" both allow me to login to my account on my system (the actual password is "nathan123", and therefore "nathan12" or anything else should NOT allow me to login).

Here's what my system does when a user registers:

[...]

$salt = uniqid(mt_rand(), true);
$password = crypt($password, $salt); // '$password' is the inputted password

$insertUserStmt = $mysqli->prepare("INSERT INTO users (name, 
username, 
password, 
password_salt, 
email, 
created) VALUES (?, ?, ?, ?, ?, ?)");

$insertUserStmt->bind_param("sssssi", $name, $username, $password, $salt, $email, time());

$insertUserStmt->execute();

[...]

It inserts the hashed/encrypted password ($password) into the database along with the $salt.

When someone tries to login, the following is done to check if the user has inputted the correct password for the username they inputted:

[...]

// $password_salt is from DB; $password is inputted password
$password_crypt = crypt($password, $password_salt); 

// $login_password is from DB
if($password_crypt == $login_password) { 

[...]

I'm probably not even using the crypt function properly, but according to the PHP docs the first parameter is a string (the password) and second is the salt.

3 Answers
Related