# Auth user with postgresql

**URL:** <https://www.ruby-forum.com/t/auth-user-with-postgresql/216947>\
**Category:** NGINX\
**Created:** [February 17, 2012, 1:40pm UTC](https://www.ruby-forum.com/t/auth-user-with-postgresql/216947 "2012-02-17T13:40:10Z")\
**Posts on this page:** 3\
**Page:** 2

<div class="post-metadata">

**Author:** ![Giuseppe\_T](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/e5b9ba/32.png) [@Giuseppe\_T](https://www.ruby-forum.com/u/Giuseppe_T)\
**Post date:** [February 22, 2012, 3:03am UTC](https://www.ruby-forum.com/t/auth-user-with-postgresql/216947/21 "2012-02-22T03:03:45Z")

</div>

21 февраля 2012, 23:22 от Giuseppe T. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> pwd =1$Ln7ocLxd/.k  
> salt =1$  
> PHP calculated and in python crypt.crypt(‘multilab’, pwd[:2] are are correct)

No, they are not, because PHP and Python are using invalid salts,  
despite  
the fact that they shouldn’t. Each value in the 0-63 range is  
represented  
by a printable salt character in the “./0-9A-Za-z” range. You are using  
an  
invalid salt character (‘$’), which the Postgresql crypt() function  
silently  
maps to value 0, which is represented by the character ‘.’ in the salt,  
so  
your ‘1$2NVPu8Urs82’ hash is actually the result of crypt(‘multilab’,  
‘1.’),  
but with the original invalid salt ‘1$’ prepended.

According to the official PHP documentation, the PHP crypt() function  
should fail if the salt contains at least one invalid character, but  
it obviously doesn’t, so you should make sure to verify the salt  
validity before calling the crypt() function.

If your users are likely to have usernames that contain characters  
other than “./0-9A-Za-z”, then you should use the Postgresql function  
gen\_salt() instead of substr($user, 1, 2) when setting passwords:

postgres\_query “UPDATE usertable SET pwd=crypt($pass, gen\_salt(‘des’))  
WHERE user=$user”;

Max

---

<div class="post-metadata">

**Author:** ![Giuseppe\_T](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/e5b9ba/32.png) [@Giuseppe\_T](https://www.ruby-forum.com/u/Giuseppe_T)\
**Post date:** [February 22, 2012, 4:54am UTC](https://www.ruby-forum.com/t/auth-user-with-postgresql/216947/22 "2012-02-22T04:54:25Z")

</div>

On Wed, Feb 22, 2012 at 9:03 AM, Max [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> should fail if the salt contains at least one invalid character, but  
> it obviously doesn’t, so you should make sure to verify the salt  
> validity before calling the crypt() function.
> 
> If your users are likely to have usernames that contain characters  
> other than “./0-9A-Za-z”, then you should use the Postgresql function  
> gen\_salt() instead of substr($user, 1, 2) when setting passwords:
> 
> postgres\_query “UPDATE usertable SET pwd=crypt($pass, gen\_salt(‘des’))  
> WHERE user=$user”;

Don’t forget that des password hashing is limited to 8 characters.  
Anything beyond that is ignored.

$ echo ‘\<?php echo crypt("12345678", "ad")."\n" ?\>’ | php  
adBh37ptDUT2o  
$ echo ‘\<?php echo crypt("123456789", "ad")."\n" ?\>’ | php  
adBh37ptDUT2o

It’s better to use something more modern like bcrypt (gen\_salt(‘bf’,  
8) in postgresql). If you want to hash it in php, import phpass[1]  
PasswordHash to get the gen\_salt equivalent function since php doesn’t  
seem to provide any.

[1] [Portable PHP password hashing ("password encryption") framework](http://www.openwall.com/phpass/)

–  
O\< ascii ribbon campaign - stop html mail - [www.asciiribbon.org](http://www.asciiribbon.org)

---

<div class="post-metadata">

**Author:** ![Giuseppe\_T](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/e5b9ba/32.png) [@Giuseppe\_T](https://www.ruby-forum.com/u/Giuseppe_T)\
**Post date:** [February 22, 2012, 11:33pm UTC](https://www.ruby-forum.com/t/auth-user-with-postgresql/216947/23 "2012-02-22T23:33:40Z")

</div>

Hi all,

Thanks to everyone who helped me to solve the problem.  
I tried with these three solutions and they worked perfectly.

PHP and Postgresql  
$pass =crypt($password, ‘$1$’)  
UPDATE usertable SET pwd=‘$pass’ WHERE user=‘$user’;

Postgresql only  
UPDATE usertable SET pwd=crypt(‘mypass’, gen\_salt(‘md5’)) WHERE  
user=‘username’;

Nginx  
postgres\_query “SELECT user FROM usertable WHERE user=$user AND  
pwd=crypt($pass, pwd)”;

Best Regards

Giuseppe

2012/2/22 Edho A. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

[Previous page](https://www.ruby-forum.com/t/auth-user-with-postgresql/216947.md?page=1)