Search code examples
phppassword-encryptionblowfishcrypt

Comparing two encrypted string with blowfish - php

I generated an encrypted string with using blowfish encryption function (crypt()) in php and stored it in database. How can I check correctness of submitted password then?

For eg. during registration, I defined my pass as "1234" and then generated a random key and then my blowfish encrypted password something like "$2a$08$xPIviMLmVMHLQdzb$$$$$.OdQVKDPJeK4KIcdqnngIgv41lILjKR." So, when user comes back, how can I check correctness of his/her password? Is there any comparing function of two encrypted string from the same base password or another efficient way? Thanks in advance.

Solution

  • Simply pass the user input from the form into the crypt function, with the hash in the database.

    For example:

    <?php
if (crypt($passwordFromPost, $hashedPasswordInDb) == $hashedPasswordInDb)
{
   // User has been authenticated
}