# Howto use ENCRYPT() function of MySQL

**URL:** <https://www.ruby-forum.com/t/howto-use-encrypt-function-of-mysql/111478>\
**Category:** Rails\
**Created:** [August 7, 2007, 8:21pm UTC](https://www.ruby-forum.com/t/howto-use-encrypt-function-of-mysql/111478 "2007-08-07T20:21:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![babyloon00](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/4da419/32.png) [@babyloon00](https://www.ruby-forum.com/u/babyloon00)\
**Post date:** [August 7, 2007, 8:21pm UTC](https://www.ruby-forum.com/t/howto-use-encrypt-function-of-mysql/111478/1 "2007-08-07T20:21:22Z")

</div>

Hi all,

I’m working actually on a Control Panel to manage a mail system.

Until now, when I create a new mail account, i do an insert and protect  
the pasword with ENCRYPT(‘password’) function.

I can’t change the method to SHA1 or MD5 because the SMTPd a IMAPd will  
not support it.

Can you explain me how to force RoR to rewrite the INSERT SQL query and  
use ENCRYPT() ?

Thank you in advance,

Damien

---

<div class="post-metadata">

**Author:** ![babyloon00](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/4da419/32.png) [@babyloon00](https://www.ruby-forum.com/u/babyloon00)\
**Post date:** [August 7, 2007, 11:01pm UTC](https://www.ruby-forum.com/t/howto-use-encrypt-function-of-mysql/111478/2 "2007-08-07T23:01:06Z")

</div>

I think you have to create a custom query:

INSERT INTO t VALUES (1,AES\_ENCRYPT(‘text’,‘password’));

try and let me know

Ajit

---

<div class="post-metadata">

**Author:** ![babyloon00](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/4da419/32.png) [@babyloon00](https://www.ruby-forum.com/u/babyloon00)\
**Post date:** [August 7, 2007, 11:14pm UTC](https://www.ruby-forum.com/t/howto-use-encrypt-function-of-mysql/111478/3 "2007-08-07T23:14:09Z")

</div>

Hi,

Thank you for the tip.

Finally, I used somethings like this in my model:

# Apply encryption to the supplied password.

def self.encrypt(pass)  
User.find\_by\_sql(“select encrypt(’#{pass}’) as enc limit  
1”)[0][‘enc’]  
end

before\_create :crypt\_password

def crypt\_password  
write\_attribute “password”, self.class.encrypt(password)  
end

---

<div class="post-metadata">

**Author:** ![babyloon00](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/4da419/32.png) [@babyloon00](https://www.ruby-forum.com/u/babyloon00)\
**Post date:** [August 7, 2007, 11:42pm UTC](https://www.ruby-forum.com/t/howto-use-encrypt-function-of-mysql/111478/4 "2007-08-07T23:42:13Z")

</div>

On Aug 7, 2007, at 16:14 , Damien Babilon wrote:

> ```
> User.find_by_sql("select encrypt('#{pass}') as enc limit
> 
> ```
> 
> 1")[0][‘enc’]

And you’ve opened yourself wide open to SQL injection attacks.

Much safer (untested):

sql = %(SELECT ENCRYPT(:password))  
User.find\_by\_sql([sql, {:password =\> pass}])

Michael G.  
grzm seespotcode net

---

<div class="post-metadata">

**Author:** ![babyloon00](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/4da419/32.png) [@babyloon00](https://www.ruby-forum.com/u/babyloon00)\
**Post date:** [August 10, 2007, 12:26pm UTC](https://www.ruby-forum.com/t/howto-use-encrypt-function-of-mysql/111478/5 "2007-08-10T12:26:27Z")

</div>

That work fine.

Thank you for your help.

Damien