# Salted\_password() in php

**URL:** <https://www.ruby-forum.com/t/salted-password-in-php/63184>\
**Category:** Engines\
**Created:** [June 13, 2006, 12:54am UTC](https://www.ruby-forum.com/t/salted-password-in-php/63184 "2006-06-13T00:54:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chris\_Fortune](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/b9bd4f/32.png) [@Chris\_Fortune](https://www.ruby-forum.com/u/Chris_Fortune)\
**Post date:** [June 13, 2006, 12:54am UTC](https://www.ruby-forum.com/t/salted-password-in-php/63184/1 "2006-06-13T00:54:26Z")

</div>

Hello,

I’m trying to implement a php version of the ruby hashed() and  
salted\_password() functions in  
/vendor/plugins/login\_engine/lib/login\_engine/authenticated\_user.rb

```
  def self.hashed(str)
    # check if a salt has been set...
    if LoginEngine.config(:salt) == nil
      raise "You must define a :salt value in the configuration for 

```

the  
LoginEngine module."  
end  
return  
Digest::SHA1.hexdigest("#{LoginEngine.config(:salt)}–#{str}–}")[0…39]  
end

```
  def self.salted_password(salt, hashed_password)
    hashed(salt + hashed_password)
  end

def crypt_password
  if @new_password
    write_attribute("salt",

```

AuthenticatedUser.hashed(“salt-#{Time.now}”))  
write\_attribute(“salted\_password”,  
AuthenticatedUser.salted\_password(salt,  
AuthenticatedUser.hashed(@password)))  
end  
end

It works great (thanks, by the way). Now php comes along and retrieves  
from  
the db the “salt” and “salted\_password” values, then attempts to SHA1  
the  
password in exactly the same way ruby did, and compare the values.  
Presumable, matching values will mean successful password match.

Can anybody see why the output of this php code is not the same as the  
login\_engine code?

\<?php function hashed($mystr){ return substr( sha1(LOGIN\_ENGINE\_CONF\_SALT."--$mystr--}"), 0, 39); } function salted\_password($salt, $hashed\_password){ return hashed($salt . $hashed\_password); } $salt = pg\_fetch\_result(pg\_query("SELECT salt FROM users WHERE login='$u'"), 0, 0); $sqlpass = pg\_fetch\_result(pg\_query("SELECT salted\_password FROM users WHERE login='$u'"), 0, 0); $salted\_password = salted\_password( $salt, hashed($\_POST['password']) ); if($sqlpass == $salted\_password){ blah blah blah } else # oH, too bad it didn't work ?\>

---

<div class="post-metadata">

**Author:** ![Chris\_Fortune](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/b9bd4f/32.png) [@Chris\_Fortune](https://www.ruby-forum.com/u/Chris_Fortune)\
**Post date:** [June 13, 2006, 7:07pm UTC](https://www.ruby-forum.com/t/salted-password-in-php/63184/2 "2006-06-13T19:07:56Z")

</div>

Top-posting to my own post from yesterday. I found the solution:

Here are the lines that matter:

Ruby

> Digest::SHA1.hexdigest("#{LoginEngine.config(:salt)}–#{str}–}")[0…39]  
> PHP  
> return substr( sha1(LOGIN\_ENGINE\_CONF\_SALT."–$mystr–}"), 0, 39);

and here’s the fix, in PHP:  
return substr( sha1(LOGIN\_ENGINE\_CONF\_SALT."–$mystr–}"), 1, 40);

Comp Sci 203. Binary representation of indices. Some index systems are  
0-based and some are 1-based. Ruby’s built in […] command has a  
0-based  
index.