Search code examples
mysqlauthenticationpasswordsmcrypt

mcrypt/mysql syntax error on login page

I've got such code as an auth file for my CMS on login page:

    //$login=true;
    $iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB);
    $iv = mcrypt_create_iv($iv_size, MCRYPT_RAND);
    $key_hex = '6ee92bd4ef85c73b834cfa59ca343b7c';
    $key_bin = pack('H*', $key_hex);
    $pas = mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $key_bin, $_SESSION['p'], MCRYPT_MODE_ECB, $iv);
    $pas=trim($pas);
    $query="select *,PASSWORD('{$pas}') as password, UNIX_TIMESTAMP() as now from adm where login='{$_SESSION['l']}' LIMIT 1";

It works great on most of the servers, but on Hostgator it doesn't :/

Query error select *,PASSWORD('ŃÇBňzŐO<~îøq'Ńsč:Á(ě/ę') as haslo, UNIX_TIMESTAMP() as now from adm where login='admin' LIMIT 1 Something is wrong in your syntax obok 'Ńsč:Á(ě/ę') as password, UNIX_TIMESTAMP() as now from adm where login='admin' LI' on line 1 Login error!

I see the password is being generated like this:

*4ACFE3202A5FF5CF467898FC58AAB1D615029441

instead of like this:

1ce99313667de467

How to correct this ?

Solution

  • It was register_globals issue. After turning it on all went ok.