MySQL Password Query Error

[rca]

I have a pretty basic login script on a couple of websites that does some basic page protection. I store a name and password in a MySQL database, using the PHP PASSWORD function to get hash the password and match it in my MySQL query. This worked until today, probably after the upgrade.

Query is basically:

SELECT * FROM user WHERE username = '$uid' AND password = PASSWORD('$pwd')

I ran the query in PhpMyAdmin and did not get a match either. Anybody know if something changed in PHP or MySQL for the PASSWORD hash?

Oh yea, I'm on Cpanel 32.

Thanks.

rca

[ChrisTech]

Just recently a few updates were performed.

cPanel/WHM
cPanel Pro (Boxtrapper, file leech protector, image manager)
MySQL 4.1.3
PHP 4.4.0

Via annoucements thread

http://forums.dathorn.com/showthread.php?p=10908

Might also want to subscribe to that forum, as it gives all of the updates for Dathorn.
Here's the "how to" on how to subscribe

http://forums.dathorn.com/showthread.php?t=1699

**edit I was too quick to reply and didn't read it fully.

[Buddha]

PASSWORD() function shouldn't be used, it's for MySQL internal use. Use MD5() instead.

[rca]

OK,

I am subscribed to the update forum so I knew upgrades had been done, I just didn't know what had changed that was causing me a problem, but I figured it out.

The newer version of MySQL changed the PASSWORD hash and the field it generates is now bigger. It used to generate a 16 byte hash and now it is 41 bytes. My password field in my databases was only 16 bytes long, so when I regenerated the passwords it could not fit all the hash in the field and when I tried to match it did not work.

Solution was to change the length of my password field in my database to 41 bytes and regenerate the passwords. This appears to have solved my problem.

rca

[Buddha]

Solution was to change the length of my password field in my database to 41 bytes and regenerate the passwords. This appears to have solved my problem.

Till the next MySQL update anyway.

[rca]

Till the next MySQL update anyway.

Exactly!

[-Oz-]

wow, things like that are friggin annoying.

[ZYV]

Try OLD_PASSWORD instead since the password hashing changed in 4.1 since 4.0... HTH.

[Ian]

This message saved me. Thanks, my login script is working again.

Easier to alter the table then to use OLD_PASSWORD imo, but good to know both.