Re: Changing Plain Text Passwords to Hashed Passwords

[Rick James]

You have to rewrite at least some code.

aes_encrypt() is one possibility. But it is overkill -- you don't really need a function that can be reversed. Instead, consider MD5().

Another security tip -- avoid passing the password in plaintext in a SQL statement. That is, do the MD5 (or whatever) in your application language, then compare the result to what is in the table.

When using MD5, you should concatenate the plaintext with a secret passphrase. Example (using php)
When creating a pwd:
$user_entry = $_POST[...];
$encrypted = MD5($user_entry . 'secret passphrase');
INSERT INTO ... $encrypted
When checking:
$user_entry = $_POST[...];
$encrypted = MD5($user_entry . 'secret passphrase');
$in_db = SELECT ...
if ($in_db != $encrypted) { echo 'bad pwd'; }