Be careful what you type for...

I have been working on the login PHP scripts and such tonight and security isn't something I am worried about right now. That being said, I do employ md5()'d passwords from the beginning for clarity purposes.

About an hour ago, I had finally gotten to a testing point to make sure all the logging in would work with the user id's in the database and all the pages that I have created redirected correctly if there was no cookie set or went to the right places if it was set (correctly). I tried to login the first time and it came up login failed. I was pretty sure I had type in the password correctly (user ID was 1, can't get that wrong), but I tried it two more times just to be sure. I ran through the source of all the PHP files and couldn't find out why the form wouldn't let me login. The only file I hadn't checked was install.php. It sets up all the databases and the default Administrator account and password. Sure enough, I had made a typo in setting up the employee database.

What I had put was:

40 $create_tables = "CREATE TABLE employee( ".
41 "empid INT NOT NULL AUTO_INCREMENT, ".
42 "empname VARCHAR(50) NOT NULL, ".
43 "emppass VARCHAR(30) NOT NULL, ".
44 "PRIMARY KEY(empid))";


Can you see what I did wrong? For those tech-savvy enough to see, it really isn't very blatant. For those who aren't very tech-savvy, MD5 hashes are 32 characters long. I was storing an 32-character string in a 30-character field, truncating the last two characters of the hash. It was coming looking like this:


mysql> select * from employee;
+-------+---------------+--------------------------------+
| empid | empname | emppass |
+-------+---------------+--------------------------------+
| 1 | Administrator | 21232f297a57a5a743894a0e4a801f |
+-------+---------------+--------------------------------+
1 row in set (0.00 sec)

mysql>


instead of like this:


mysql> select * from employee;
+-------+---------------+----------------------------------+
| empid | empname | emppass |
+-------+---------------+----------------------------------+
| 1 | Administrator | 21232f297a57a5a743894a0e4a801fc3 |
+-------+---------------+----------------------------------+
1 row in set (0.00 sec)

mysql>


The bug was in the absolute last place I expected it to be, but I guess that is how it goes sometimes...

PS: Sorry the MySQL tables get a bit screwed up, Blogger deletes unneeded tabs...