Website: Password Hashing

// password.ts
import crypto from "crypto";

const PREFIX = "$pbkdf2-sha256$i=";
const ITERATIONS = 15000;   // = PasswordHashIterations in JoinServer.ini

export function hashPassword(password: string): string {
  const salt = crypto.randomBytes(16);
  const output = crypto.pbkdf2Sync(password, salt, ITERATIONS, 32, "sha256");
  return `${PREFIX}${ITERATIONS}$${salt.toString("base64")}$${output.toString("base64")}`;
}

export interface VerifyResult {
  valid: boolean;
  rehash: boolean;   // true = write hashPassword(password) back to the row
}

export function verifyPassword(password: string, stored: string): VerifyResult {
  if (!stored.startsWith(PREFIX)) {
    // Old plain-text row (LegacyPasswordMode = 0)
    const valid = stored.length > 0 && password === stored;
    return { valid, rehash: valid };
  }

  const parts = stored.slice(PREFIX.length).split("$");
  if (parts.length !== 3) return { valid: false, rehash: false };

  const iterations = parseInt(parts[0], 10);
  const salt = Buffer.from(parts[1], "base64");
  const expected = Buffer.from(parts[2], "base64");
  if (!(iterations >= 1 && iterations <= 10_000_000) || expected.length !== 32) {
    return { valid: false, rehash: false };
  }

  const actual = crypto.pbkdf2Sync(password, salt, iterations, 32, "sha256");
  const valid = crypto.timingSafeEqual(actual, expected);
  return { valid, rehash: valid && iterations < ITERATIONS };
}

export function isValidGamePassword(password: string): boolean {
  return /^[\x21-\x7E]{4,10}$/.test(password);   // printable ASCII, 4-10 chars
}

<?php
// password.php
const PW_PREFIX = '$pbkdf2-sha256$i=';
const PW_ITERATIONS = 15000;   // = PasswordHashIterations in JoinServer.ini

function hashPassword(string $password): string {
    $salt = random_bytes(16);
    $output = hash_pbkdf2('sha256', $password, $salt, PW_ITERATIONS, 32, true);
    return PW_PREFIX . PW_ITERATIONS . '$' . base64_encode($salt) . '$' . base64_encode($output);
}

/** @return array{valid: bool, rehash: bool} */
function verifyPassword(string $password, string $stored): array {
    if (strpos($stored, PW_PREFIX) !== 0) {
        // Old plain-text row (LegacyPasswordMode = 0)
        $valid = $stored !== '' && hash_equals($stored, $password);
        return ['valid' => $valid, 'rehash' => $valid];
    }

    $parts = explode('$', substr($stored, strlen(PW_PREFIX)));
    if (count($parts) !== 3) return ['valid' => false, 'rehash' => false];

    $iterations = (int)$parts[0];
    $salt = base64_decode($parts[1], true);
    $expected = base64_decode($parts[2], true);
    if ($iterations < 1 || $iterations > 10000000 || $salt === false || $expected === false || strlen($expected) !== 32) {
        return ['valid' => false, 'rehash' => false];
    }

    $actual = hash_pbkdf2('sha256', $password, $salt, $iterations, 32, true);
    $valid = hash_equals($expected, $actual);
    return ['valid' => $valid, 'rehash' => $valid && $iterations < PW_ITERATIONS];
}

function isValidGamePassword(string $password): bool {
    return preg_match('/^[\x21-\x7E]{4,10}$/', $password) === 1;   // printable ASCII, 4-10 chars
}

import sql from "mssql";
import { hashPassword, isValidGamePassword } from "./password";

if (!isValidGamePassword(password)) throw new Error("Password: 4-10 letters, digits or symbols");

await pool.request()
  .input("id", sql.VarChar(10), username)
  .input("pwd", sql.VarChar(120), hashPassword(password))   // 120, not 10
  .input("mail", sql.VarChar(50), email)
  .query(`INSERT INTO MEMB_INFO (memb___id, memb__pwd, memb_name, sno__numb, bloc_code, ctl1_code, mail_addr, appl_days)
          VALUES (@id, @pwd, @id, '1111111111111', '0', '0', @mail, GETDATE())`);

if (!isValidGamePassword($password)) throw new Exception('Password: 4-10 letters, digits or symbols');

$st = $db->prepare("INSERT INTO MEMB_INFO (memb___id, memb__pwd, memb_name, sno__numb, bloc_code, ctl1_code, mail_addr, appl_days)
                    VALUES (?, ?, ?, '1111111111111', '0', '0', ?, GETDATE())");
$st->execute([$username, hashPassword($password), $username, $email]);

import { hashPassword, verifyPassword } from "./password";

const r = await pool.request()
  .input("id", sql.VarChar(10), username)
  .query("SELECT memb__pwd FROM MEMB_INFO WHERE memb___id = @id");

const stored = r.recordset[0]?.memb__pwd ?? "";
const check = verifyPassword(password, String(stored));

if (!check.valid) return fail("Wrong username or password");

if (check.rehash) {
  // Old plain-text row or old iteration count: upgrade it now. Never block the login on this.
  await pool.request()
    .input("id", sql.VarChar(10), username)
    .input("pwd", sql.VarChar(120), hashPassword(password))
    .query("UPDATE MEMB_INFO SET memb__pwd = @pwd WHERE memb___id = @id")
    .catch(() => {});
}

// ... start the session

$st = $db->prepare('SELECT memb__pwd FROM MEMB_INFO WHERE memb___id = ?');
$st->execute([$username]);
$stored = (string)($st->fetchColumn() ?: '');

$check = verifyPassword($password, $stored);
if (!$check['valid']) fail('Wrong username or password');

if ($check['rehash']) {
    // Old plain-text row or old iteration count: upgrade it now.
    try {
        $db->prepare('UPDATE MEMB_INFO SET memb__pwd = ? WHERE memb___id = ?')
           ->execute([hashPassword($password), $username]);
    } catch (Throwable $e) { /* never block the login on this */ }
}

// ... start the session