[Tayab]

Before I begin this tutorial, I have few words to say. I didn't find any tutorial about MD5 so I thought to create one. I know most of you guys don't like MD5 and it's easy to be decoded. But it handy while you're working in MySQL and especially making a UCP. This is my first tutorial, I am sorry if I've got any mistakes in there.



What is Hashing System?

Hashing is when you encrypt your data into random characters (d54dhfdsAG64dfdGy) so that it's impossible for hacker to guess it. Mostly hashing is used in account passwords to protect them. Hashing is not when you change the style of the dialog to DIALOG_STYLE_PASSWORD



What this does is it only changes the input your typed into those round bullets, but it actually saves the data as typed. However it's also useful to protect your account because while typing the password, the person sitting by you won't see it.


Do I have to have Hashing System?

You don't have to have the Hashing System on your server but it's often highly recommended because there are always hackers around the server and they can inject your database, getting all the information in it. And because you won't have the passwords hashed they'll print out like this.



And you realize that it's vulnerable to have your password not hashed. But however if you have your passwords hashed it's as hardly as impossible for hacker to hack the account.



This is 100 times more secure than the above. Now you decide whether you want to have the hashing system or not.

How to setup a Hashing System on the server?

There are lots of Hashing Systems that you can use and everyone has it's own pros and corns. However if you're using MySQL and have UCP for your server, I'd recommend using MD5, because it's supported by PHP and on the UCP you can easily do the password changes. Whirlpool is also one of my favorite because it's very much protected, much more than MD5.

The best thing about MD5 is that if you're using it for MySQL, you don't need to have any include/plugin. Because you'll simple use md5 function in the query.

pawn Код:

format(query,sizeof(query),"SELECT `username` FROM `users` WHERE `username` = '%s' AND `password` = md5('%s')",pName(playerid),inputtext);

That is example of my login/register dialog check. This is how easy is to use MD5 without a plugin.

You put your string inside the MD5 brackets like this.

pawn Код:

md5("This is md5");

This will change the string to: 15e4a02b0983f903dc05639c7137bc0b

Thanks for watching!

[Emmet_]

MD5 is VERY outdated. Collisions have been found and some people have already cracked certain hashes.

SHA1() is cryptographically more secure than MD5(), try using it instead.

[Tayab]

But the thing is it's good if you've got UCP for your server. You can easily change the pass from the web.

[BigETI]

Quote:

Originally Posted by Tayab But the thing is it's good if you've got UCP for your server. You can easily change the pass from the web.

And other methods don't?

[ame]http://youtube.com/watch?v=8ZtInClXe1Q[/ame]

[Vince]

Most hosts offer MySQL 5.5 these days. This includes sha2 (sha512) which is much more secure. PHP's hash() functionality also supports sha2 or even whirlpool. Combine it with a salt for even more security.