Today we will see how to reset the OpenCart password (e-commerce system in PHP) manually, directly in the database; generating the hash and the salt manually with a function created by me.
Function that generates salt and new password
Here I leave the code, and the explanation at the end.
The function returns an array that has the salt and the password, the way to call it is to pass the password in plain text. You can try and use the function here.
Once you have the salt and the password just do an update of your database table.
In my case:
My table is called
oc_user because when I installed OpenCart I used that prefix, in your case it can vary.
The algorithm and the way that OpenCart uses it
Thanks to OpenCart is open source we can see how it generates the salt and saves the hashes.
In its source code it implements obtaining a cryptographically secure random string and then uses sha1 to hash it, concatenating it with the user’s password.
The generation of the salt is as follows:
It uses the function called
token defined in helpers/general. php and then calls it, obtaining a random string of 9 digits. Then concatenate it and hash it with SHA1:
Finally, in the database it saves everything in the user table in the salt and password fields:
Knowing all those things we could write a function that generates the salt and the password to be able to reset the password of a user manually in OpenCart.
Sometimes we need to create a random string or token using PHP. For example, it’s quite common that when we want to reset our password on some website a message is sent to the mail we registered.
Probably the message have a link like this:
Where 123 is the token. Today we will see how to create a token cryptographically secure using PHP. We can use this token as a password or as random string to reset something.
This works for PHP 5 and for PHP 7.