Friday, November 8, 2013

URL parameters value encryption/decryption using MD5 to Authenticate value stored in database field

You can create a hash of the id so you get something like:
 
http://www.demo.com/displaycommittees.php?id=81dc9bdb52d04dc20036dbd8313ed055

In you db query you can do a select on the users table including a WHERE statement that also hashes the id column like:
 
WHERE MD5(id) = $_GET[id]

A side note to this is that MD5 hashes do not necessarily have to be unique. So you cannot be sure that this select statement is always returning the row you wanted. 

This works fine and i have always applied this algorithm. for instance assuming the actual value of the encrypted id 23, if you try to put 23 in place of the encrypted code it will not work( no result will be display).

No comments:

Post a Comment