mysql password() in js

Question

I would like to generate the mysql-password hash from js.

I know the method with php functions,

$p = "example";
echo("$p<br>");
$p2= sha1($p,true);
echo("$p2<br>");   //ĂI')s~űvŠ-Ëo?
$result = sha1($p2);
echo("$result<br>"); //*57237bb49761f29ab9724ba084e811d70c12393d - this is the same as password("example") in mysql

and I'm trying to do this in javascript.

here is located the sha1 function: http://pajhome.org.uk/crypt/md5/sha1.html

this is the hex2bin function I use to give the same result as sha1("",true);

function hex2bin(hex)
{
    var   bytes = [], str;

    for(var i=0; i< hex.length-1; i+=2)
        bytes.push(parseInt(hex.substr(i, 2), 16));
    return String.fromCharCode.apply(String, bytes);    
}

but at the last step it does not work. What can be the problem?

var p = "example";
console.log(p);
var p2 = hex2bin(hex_sha1(p));
console.log(p); //ÃI')s~ûv©-Ëo? - SEEMS OK
var result = hex_sha1(p2);
console.log(result); //9a5355dce26b1adfa0bdbe9f2b2a6e5ae58e5c9d WRONG

Why do you want to do it in javascript? If you know how to do it in php, why not request the result from a php file? — Ash Burlaczenko
– Ash Burlaczenko, Commented Mar 29, 2012 at 9:23
Maybe you should start from the begin of what your trying to do. Generating a hashed password in javascript is not secure. — Ash Burlaczenko
– Ash Burlaczenko, Commented Mar 29, 2012 at 9:26
On the server? If your sending the password back to the server then the password is open to the public. You should send the password before encryption and hash it on the server before storing it in the db. — Ash Burlaczenko
– Ash Burlaczenko, Commented Mar 29, 2012 at 9:43

Viktor Yarmak · Accepted Answer · 2012-12-01 19:40:36Z

3

Use http://code.google.com/p/crypto-js/#SHA-1 with 2 encodings.

Here is an example:

var password = "TestPassword";
var result = ("*"+CryptoJS.SHA1(CryptoJS.SHA1(password))).toUpperCase();
console.log("result : " + result);

Result will be *0F437A73F4E4014091B7360F60CF81271FB73180. If you check it with mysql password() it will be the same:

mysql> select password("TestPassword") as result;
+-------------------------------------------+
| result                                    |
+-------------------------------------------+
| *0F437A73F4E4014091B7360F60CF81271FB73180 |
+-------------------------------------------+

answered Dec 1, 2012 at 19:40

Viktor Yarmak

1812 silver badges9 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Edvaldo Silva · Accepted Answer · 2017-02-27 00:19:10Z

1

SOLUTION 2017

Download file 2.5.3-crypto-sha1.js
https://code.google.com/archive/p/crypto-js/downloads

var key = '*' + Crypto.SHA1(Crypto.util.hexToBytes(Crypto.SHA1('test'))).toUpperCase();

key = *94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29


Test in MySQL

SELECT PASSWORD('test') /* function */
UNION
SELECT '*94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29' /* Key generated by javascript */ 
UNION
select CONCAT('*', UPPER(SHA1(UNHEX(SHA1('test'))))); /* Logic for Password() function */

answered Feb 27, 2017 at 0:19

Edvaldo Silva

9442 gold badges17 silver badges31 bronze badges

Comments

Jovan Perovic · Accepted Answer · 2012-03-31 16:44:15Z

0

So, in the example above, you are invoking: hex_sha1(hex2bin(hex_sha1(string))). Are you sure that is correct? Why would you need hex_sha1 twice?

Few month ago, I needed SHA1 in my JS and found this: http://phpjs.org/functions/sha1:512

... and it worked pretty ok ;)

The solution (partly):

Well, as you suggested, the main problem was charset encoding. It seems that MySQL does not encode any data prior to hashing it. This does not represent problem when dealing it with hex data, however, MySQL's UNHEX(hex2bin in JS) returns some unreadable chars and if we encode the result using UTF8 that's where all breaks apart.

When I edited JS's SHA1 not to encode data to UTF8 at line (I only commented the line):

str = this.utf8_encode(str);

everything seemed ok. However, as soon as I supplied some UTF8 chars to input (such as Central European chars čćžšđ) it started failing again.

So, bottom line, if you disable UTF8 in JSs SHA1 function and do not supply UTF8 chars on input it works fine.

I'm sure there is a solution to this such as JS function that will decode UTF8 input so, JS could hash it properly.

edited Mar 31, 2012 at 16:44

answered Mar 29, 2012 at 9:26

Jovan Perovic

20.2k5 gold badges47 silver badges92 bronze badges

4 Comments

user669677 Over a year ago

because the mysql password hash is created that way. It uses for some reason sha1 algorithm twice.

user669677 Over a year ago

I have tired your algorithm but it gives at the end 9a5355dce26b1adfa0bdbe9f2b2a6e5ae58e5c9d so hax2bin is wrong/ or some character encoding problem???

Jovan Perovic Over a year ago

Well, I played a bit with UNHEX and your hex2bin functions and strangely enough when I supply constant argument they work the same. On the other hand when I supply sha1 hashes (both the same) they output different value. I'll keep digging a little more and let you know if I find anything useful...

user669677 Over a year ago

I gived up width this, and have chosen a more secure way: https. | I guess the base64_encode could solve this problem fully.

Collectives™ on Stack Overflow

mysql password() in js

3 Answers 3

Comments

Comments

The solution (partly):

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

The solution (partly):

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related