2 replies to this topic

[sydjeii]

I was searching the forum about how oscommerce encrypts the data stored in the database and I found out that it uses md5 encryption. I also learned that md5 is a one way encryption and cannot be decrypted..so i was wondering how oscommerce "retrieve" (not sure about the term to use) passwords from the database example when a customer logs in.. how does oscommerce check if the password entered on the form matches the password from the database since it is encrypted and cannot be decrypted?

[DunWeb]

CJ,


Look at the /includes/functions/password_funcs.php file for password validations


Chris

Edited by DunWeb, 14 January 2012, 02:32.

[germ]

With a "one way encryption" method it works like this.

The password is encrypted and stored in the database when it is created.

When the customer logs in the code takes the password typed into the box on the login page and runs it thru the same encryption then compares the result of that with what is stored in the database.

If the encryption of what they typed into the password box matches the encrypted data stored in the DB then they have typed in the correct password.

The code never recreates the original password it just compares encryption results.

Edited by germ, 14 January 2012, 11:32.