I need to update my records. I want to change our plaintext passwords into MD5 encoded passwords. This is what I tried to use:
UPDATE testing SET password = MD5('Manojano234')
This query was working for the string I put in there, but I need to be encoding the password and not just that one string
This is really what you want to do. Appending a MD5ed salt to and MD5ed password is not the way to go. An attacker would see that there are two MD5ed strings concatenated together, as the last part of every password would be the same. Appending them and then MD5ing is the way to go. Use this:
UPDATE testing SET password = MD5(CONCAT(password, 'A Custom Salt You Pick'));
You have to write something like this:
UPDATE testing SET password = CONCAT(MD5(password), 'plain text')
You can write your query like :
UPDATE testing SET password = CONCAT(MD5(password), MD5('Your plain text')) WHERE "Need to write your condition to update this record"
This is one way to convert your plain text passwords into MD5 passwords. I am also appending a salt.
UPDATE testing SET password = CONCAT(MD5(password), MD5('plain text'))
Related
SELECT * FROM Customers WHERE password LIKE '%%';
This statement is incorrect but is there a way to find password that start with '%','''','!',etc.
I am Trying to find password that start with any symbol in front ? How can I do that ?
Example Password :%$rk3d+R&
Note that you should not be storing clear text passwords in your customers table. Doing so exposes your site to significant risk, if someone ever finds a way to read your database table. Instead, you should always store an irreversible hash of the password in the customers table. Then, for user authentication, hash a user's input password and compare against the table.
That being said, the % has a special meaning when used inside a LIKE expression, and it means any number of characters. You may escape it via a backslash in this case to mean a literal % symbol:
SELECT * FROM Customers WHERE password LIKE '\%%';
More generally, to find customers having passwords starting with any symbol, use REGEXP:
SELECT * FROM Customers WHERE password REGEXP '^[##$%^&*]';
You need to escape the special character here like below.
SELECT * FROM test where password like '\%%';
Demo DBFiddle
Is there any way to encrypt only data that are not encrypted yet?(Is there any way you can tell encrypted and non-encrypted data apart?)
Please assume that I have a column that some data are already encrypted but some are not.
Code for encrypt
update usersExample3 set password=aes_encrypt(password,'1234');
I have a stored procedure that I have to fix it but not sure how:
DELIMITER //
CREATE PROCEDURE de ()
LANGUAGE SQL
DETERMINISTIC
SQL SECURITY DEFINER
COMMENT 'A procedure'
BEGIN
while(there is any not encrypted data in the table)
--if(usersExample3.password is not encrypted yet)
update usersExample3 set password=aes_decrypt(password,'1234');
--else (do nothing)
END//
;
Sample of my database:
select * from usersExample3 where userId<=5;
userId username password salt
1 Tom Password1234 NULL
4 bdfg θ¨¾jj;öN/yë‘ bcv
5 test test test
So here I want to update all data that are not encrypted yet(in this sample are userId 1 and 5.
the problem is that everyone add data in database so when data saved in table, I have a trigger(after insert) that call this stored procedure to encrypt the new data automatically.
Thanks
In the general case - no, you can't tell encrypted and non-encrypted data apart. Buuut, looking at your example, perhaps we can come close. The non-encrypted passwords will have "normal" characters that people can type on their keyboards. The encrypted ones will have all sorts of binary junk that doesn't make sense. So the first idea is to simply check if the password has characters with ASCII codes <32 or >127.
However this is not fool-proof yet. Sometimes people use more complicated characters too. If someone enters Glāžšķūņu rūķīši as their password, it's still legit words in some language (Latvian in this case) but you'll probably think it as encrypted.
Which brings us to the question - what is the character set of the column? And this is one place which looks suspicious to me from the start, because how are you storing both normal text and binary junk in there? Smells like someone doesn't understand characters sets, because doing this would under normal circumstances create a big mess.
Anyway, in case it's utf-8 text stored in a latin-1 column (a common situation), you can actually use it to your advantage for now - all the cells that are not a valid utf-8 string (plus those that have characters <32) will be encrypted.
(However if this really is the case, I strongly advise you to fix it soon and ensure that utf-8 is used EVERYWHERE from the beginning to the end. MUCH less headache that way. Here's mandatory reading about the whole character set thingy)
Using phpmyadmin, I want to run a query that will search my entire database for:
http://example.com
And replace with:
https://example.com
My SQL knowledge is limited, maybe something like:
UPDATE ?? = REPLACE(??, 'http://example.com', 'https://example.com');
The database is over 1gb, so what can I run that will not crash the server.
Update: Note that while there are other answers posted here on SO that deals with search and replace, they don't seem to cover the entire database.
use REPLACE. and if there is a index on the field then the UPDATE can use them
UPDATE t
set url = REPLACE(url, 'http:', 'https:')
WHERE url LIKE '%http:%';
only change example.com
this will only find row with 'http://example.com'
UPDATE t
set url = REPLACE(url, 'http:', 'https:')
WHERE url LIKE '%http://example.com%';
or this will find all rows with http:// but only change only this http://example.com to https://example.com
UPDATE t
set url = REPLACE(url, 'http://example.com', 'https://example.com')
WHERE url LIKE '%http:%';
Warning, the answers given so far will mess up serialized data!
For example, say your site stores serialized data in a row with the URL in it, like this:
a:1:{i:0;s:19:”http://example.com”;}
Notice that the value of this item has 19 characters, and is denoted by s:19 in the array.
If you replace content using a SQL query, the same row on your new environment would end up like this:
a:1:{i:0;s:19:”https://example.com”;}
But after this change, the value is now 20 characters long meaning s:19 is incorrect. This invalidates the array and the entire row.
So either you make sure your SQL statements deal with serialized data, or if you happen to be using WordPress then there are a few options to search using PHP so as to not break the serialized rows:
The Better Search Replace plugin automatically handles serialized
data
The Search and Replace plugin offers an option which handles
serialized data
Taken and adapted from: https://wpengine.com/support/wordpress-serialized-data/
I would use insert:
update t
set url = insert(url, 5, 0, 's')
where url like 'http:%';
For some reason MySQL is putting all passwords as the same even after md5 and using the password('$md5_password').
Let's say the password is abc123 the password stored in mysql is 11ab5e691dcc370b. But when I try to save a password of frogs the password stored is 11ab5e691dcc370b, which is the same. I have the same script on other databases and is working flawlessly.
The above would explain why no one is logging in unless I hard set the 11ab5e691dcc370b password. Then others can login.
The mysql user has full rights.
I used Google to reverse 11ab5e691dcc370b. It seems to be the hash of d41d8cd98f00b204e9800998ecf8427e, which is an MD5 of a blank string.
You might want to check the code that actually calls md5.
Assuming PHP based on the $md5_password in your question
Use double quotes or remove them completely.
md5($password);
If you use single quotes it will literally hash the string $password
md5('$password');
See this page on string literals http://www.php.net/manual/en/language.types.string.php#language.types.string.syntax.single
I was wondering how can i limit my password to aplhanmeric based on the generated value of alphanumeric AES_ENCRYPT() in mysql? I have a column password with a datatype of varbinary
Sample: select AES_ENCRYPT('encryption_code','password');
Result: ���"F]���\�L7z
I want to avoid the special characters.
This doesn't specifically answer the question on how to get just alphanumeric, but the 'special characters' look to be what MySQL does with utf8. You can see what they actually are in:
SELECT CONVERT(AES_ENCRYPT('encryption_code','password') USING latin1);
Now as to why you want just the alpha-numeric, may I ask why? Wouldn't that destroy the encryption when you go to AES_DECRYPT? With the above query, you can get the encryption_code back by doing:
SELECT AES_DECRYPT(CONVERT(AES_ENCRYPT('encryption_code','password') USING latin1), 'password');