Resetting your mysql root password

It is quite frequent that an administrator simply forgets his mysql's root password.

Luckily, it is quiet easy to reset it, here are the steps:

1. SSH as root to your machine
2. Turn off the mysqld daemon if running
• RedHat/Fedora users can do so by executing:  service mysqld stop
3. Run safe_mysqld by executing:
• safe_mysqld --skip-grant-tables
  (this will run allow you to connect without a password)
4. Open a second shell / SSH again and execute:
• mysql mysql
  (to directly connect and select the mysql database which contains the user authentication data)
5. On the mysql prompt, execute:
• update user set password=password('newpassword') where user='root';
  where newpassword is your newly chosen password.
6. That's it! close everything and start your mysql daemon again:
• service mysqld start

Password Encryption and Decryption Technique in PHP

I’ve noticed that many of my friends are storing password in database without encrypting them. This is really a bad technique because if somebody who has access of the database can easily know the password of the particular person.

The best functions available in PHP for encryption are md5() and sha1(). These both are one way encryping mechanism i.e the string encrypted with md5() or sha1() can’t be decrypted to original string. You might be then wondering how to validate the original string with the encrypted string then you can do this by encrypting the original string and compare both string,

$string='roshan'; //this is original string

$encrypted='d6dfb33a2052663df81c35e5496b3b1b'; //which is md5('roshan')

if(strcmp(md5($string),$encrypted)==0)

  echo"Valid string";

else

  echo"Invalid string";

md5() and sha1() provides the same functinality of encryption in php but they differ in a simple way that md5() generates 32 characters of encrypted string which sha1() generates same of 40 characters.Now let’s look at the different scenario where you need to store the password encrypted in the database and you need to send the originalpasword to the member of your website. In this situation, you can’t use md5() or sha1() because you need to reset the password once if forget it. Now at this time functions like base64_encode() and gzdeflate() comes handy.You can decrypt the password encrypted with base64_encode() with base64_decode() and the same applies for gzdeflate() with gzinflate().

For those guyz who really wants to encrypt and store the password with their own encryption and decryption mechanism then here is the function i’ve used in some of my web projects.

//function to encrypt the string

function encode5t($str)

{

  for($i=0; $i<5;$i++)

  {

    $str=strrev(base64_encode($str)); //apply base64 first and then reverse the string

  }

  return $str;

}

//function to decrypt the string

function decode5t($str)

{

  for($i=0; $i<5;$i++)

  {

    $str=base64_decode(strrev($str)); //apply base64 first and then reverse the string}

  }

  return $str;

}

In this function, i’ve encrypted the string 5 times with base64_encode and reversing the string with strrev() and for decrypting 5 times by reversing the string first then applying base64_decode() .

Encrypt Passwords in the Database

If you are developing a password-protected web site, you have to make a decision about how to store user password information securely.

What is "secure," anyway? Realize that the data in your database is not safe. What if the password to the database is compromised? Then your entire user password database will be compromised as well. Even if you are quite certain of the security of your database, your users' passwords are still accessible to all administrators who work at the Web hosting company where your database is hosted. Scrambling the passwords using some home-brewed algorithm may add some obscurity but not true "security." Another approach would be to encrypt all passwords in your database using some industry-standard cipher, such as the Message-Digest Algorithm 5 (MD5).

MD5 encryption is a one-way hashing algorithm. Two important properties of the MD5 algorithm are that it is impossible to revert back an encrypted output to the initial, plain-text input, and that any given input always maps to the same encrypted value. This ensures that the passwords stored on the server cannot be deciphered by anyone. This way, even if an attacker gains reading permission to the user table, it will do him no good.

MD5 does have its weaknesses. MD5 encryption is not infallible: if the password is not strong enough, a brute force attack can still reveal it. So, you can ask: "Why should I use MD5 if I know it is not the most secure?" The answer is fairly straightforward: it's fast, it's easy, and it can be powerful if salted. The greatest advantage of MD5 is its speed and ease of use.

It is vitally important to understand that password encryption will not protect your website, it can protect your passwords only. If your website does not have sufficient protection, password encryption will not make it safe from cracking. If your system has been cracked, a hacker can inflict a irreparable damage to it and also gain an access to confidential information, including passwords database. But if you store this information encrypted, hackers practically cannot make use of it. Cracking an encrypted password takes a large amount of time and processing power, even on today's computers.

So, let's start. First of all, you need to add a new account to your database. The following code allows to do it.

<?php define("DB_SERVER", "localhost"); define("DB_USER", "your_name"); define("DB_PASS", "your_pass"); define("DB_NAME", "your_db"); define("TBL_USERS", "users_table_name"); $connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS) or die(mysql_error()); mysql_select_db(DB_NAME, $connection) or die(mysql_error()); ... function addNewUser($username, $password){    global $connection;    $password = md5($password);    $q = "INSERT INTO ".TBL_USERS." VALUES ('$username', '$password')";    return mysql_query($q, $connection); } ?>

Now, when a new user completes the registration form, his password will be encrypted automatically.

After that we should write code that validates a given username/password pair.

<?php function checkUserPass($username, $password){    global $connection;          $username = str_replace("'","''",$username)    $password = md5($password);    // Verify that user is in database    $q = "SELECT password FROM ".TBL_USERS." WHERE username = '$username'";    $result = mysql_query($q, $connection);    if(!$result || (mysql_numrows($result) < 1)){      return 1; //Indicates username failure    }            // Retrieve password from result    $dbarray = mysql_fetch_array($result);       // Validate that password is correct    if($password == $dbarray['password']){       return 0; //Success! Username and password confirmed    }    else{       return 1; //Indicates password failure    } } ?>

And what if you already have users' database ready and want to start using encrypted passwords? To do it, you need to write encypt.php script with the following code and run it in your browser.

<?php define("DB_SERVER", "localhost"); define("DB_USER", "your_name"); define("DB_PASS", "your_pass"); define("DB_NAME", "your_db"); define("TBL_USERS", "users_table_name"); define("FLD_USER", "username_field_name"); define("FLD_PASS", "password_field_name"); set_magic_quotes_runtime(0); $connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS) or die(mysql_error()); mysql_select_db(DB_NAME, $connection) or die(mysql_error()); $q = "SELECT ".FLD_PASS.",".FLD_USER." FROM ".TBL_USERS.""; $result = mysql_query($q, $connection); $total=0; $enc=0; $doencrypt=false; if (@$_REQUEST["do"]=="encrypt")   $doencrypt=true; while($data = mysql_fetch_array($result)) {   if ($doencrypt)   {     $total++;     if (!encrypted($data[0]))     {       $q="UPDATE ".TBL_USERS." SET ".FLD_PASS."='".md5($data[0])."' where ".FLD_USER."='".       str_replace("'","''",$data[1])."'";       mysql_query($q, $connection);     }    $enc++;  }  else  {    $total++;    if (encrypted($data[0]))      $enc++;  } } function encrypted($str) {   if (strlen($str)!=32)     return false;   for($i=0;$i<32;$i++)     if ((ord($str[$i])<ord('0') || ord($str[$i])>ord('9')) && (ord($str[$i])<ord('a') || ord($str[$i])>ord('f')))      return false; return true; } ?> <html> <head><title>Encrypt passwords</title></head> <body> Total passwords in the table - <?php echo $total; ?><br> <?php if($enc==$total && $total>0) { ?> All passwords are encrypted. <?php } else if($total>0) { ?> Unencrypted - <?php echo $total-$enc; ?><br><br> Click "GO" to encrypt <?php echo $total-$enc; ?> passwords.<br> WARNING! There will be no way to decipher the passwords.<br> <input type=button value="GO" onclick="window.location='encrypt.php?do=encrypt';"> <?php } ?> </body> </html>