Insecure Password Storage

This page demonstrates a critical cryptographic failure: storing user passwords in plain text.

Why this is bad: If an attacker accesses the database, they immediately see every user’s password — no cracking required.

Below is the PHP code responsible for this vulnerability:

<?php
  $username = $_POST['username'];
  $password = $_POST['password']; // Plaintext!

  $query = "INSERT INTO crypto_users (username, password, is_hashed)
            VALUES ('$username', '$password', 0)";
  mysqli_query($conn, $query);
?>
  

✔ No hashing
✔ No encryption
❌ Just raw credentials saved as-is

Try it: Create a few users with different passwords and see how they’re stored.

This is a real-world mistake still found in many systems — especially legacy or rushed applications.