MySQL加密（）與鹽接受密碼後的隨機字符

密碼通過MySQL加密（）與鹽（密碼的前兩個字符）一起進行加密。

最近我已經注意到MySQL即使在最後包含隨機字符也會接受密碼。

假設我們有這樣的表：

SET NAMES utf8; 
SET foreign_key_checks = 0; 
SET time_zone = 'SYSTEM'; 
SET sql_mode = 'NO_AUTO_VALUE_ON_ZERO'; 

DROP TABLE IF EXISTS `user`; 
CREATE TABLE `user` (
    `id` int(11) NOT NULL AUTO_INCREMENT, 
    `username` varchar(255) DEFAULT NULL, 
    `password` varchar(255) DEFAULT NULL, 
    PRIMARY KEY (`id`) 
) ENGINE=MyISAM DEFAULT CHARSET=utf8; 

INSERT INTO `user` (`id`, `username`, `password`) VALUES 
(11, 'ricardomontalban', ENCRYPT(11111111,11));

現在我查詢我的用戶：

-- The following shows the appropriate response -- 
SELECT * FROM user WHERE username = "ricardomontalban" AND password = ENCRYPT(11111111,11); 

-- HOWEVER, the following query also shows a result, even with random characters appended!!! -- 
SELECT * FROM user WHERE username = "ricardomontalban" AND password = ENCRYPT("11111111-55669964s5465sqsfqsdf",11); 

-- No problem with prepended random characters though -- 
SELECT * FROM user WHERE username = "ricardomontalban" AND password = ENCRYPT("smlkfjmlsdkfjslqf-11111111",11);

我創建了一個SQL小提琴實時顯示這個例子： http://sqlfiddle.com/#!2/898d5/9

我在做什麼錯？我是否應該使用這種加密方法？任何建議，非常感謝。

來源

2013-04-30 maartenmachiels