Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #15070

Re: session management

Show all headers | View raw

On 07/03/15 11:59, jorn@jorna.dk wrote:
> On Thu, 05 Mar 2015 14:18:27 +0100, Erwin Moller
> <erwinmollerusenet@xs4all.nl> wrote:
>
>> What actually happens (but I didn't see your code of course) is
>> something like this:
>>
>> 1) You present the visitor a page with a login: username and password
>> for example.
>> They reside in a form. Form is posted, and server does something like this:
>>
>> <?php
>>
>> session_start(); // Or use session.autostart in php.ini
>>
>> // Receive posting
>> $username = $_POST["username"];
>> $password = $_POST["password "];
>>
>> // Check against database:
>> $SQL = "SELECT userid, isadmin, cansendemail FROM tblusers where
>> ((username={$username}) AND (password={$password}))";
>> // NEVER use the above example as I posted.
>> // You should make sure you are not vunurable to SQL injection
>> // make sure you escaped $username and $password properly.
>
> And *never* save passwords in clear text in a database.
> User passwords should *always* be hashed!

Hashing ain't enough, you need to salt it too, speacially if using weak 
hashing like sha1.

-- 

  //Aho

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

session management mrr <mireero@free.fr> - 2015-03-05 08:51 +0100
  Re: session management Erwin Moller <erwinmollerusenet@xs4all.nl> - 2015-03-05 11:54 +0100
    Re: session management mrr <mireero@free.fr> - 2015-03-05 13:59 +0100
      Re: session management Erwin Moller <erwinmollerusenet@xs4all.nl> - 2015-03-05 14:18 +0100
        Thank all! Re: session management mrr <mireero@free.fr> - 2015-03-06 13:47 +0100
          Re: Thank all! Re: session management "J.O. Aho" <user@example.net> - 2015-03-07 08:53 +0100
        Re: session management Jørn Andersen <jorn@jorna.dk> - 2015-03-07 11:59 +0100
          Re: session management "J.O. Aho" <user@example.net> - 2015-03-07 14:21 +0100
            Re: session management mrr <mireero@free.fr> - 2015-03-11 22:23 +0100
              Re: session management Jerry Stuckle <jstucklex@attglobal.net> - 2015-03-11 16:40 -0400
              Re: session management "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-03-11 21:59 +0100
                Re: session management mrr <mireero@free.fr> - 2015-03-13 01:05 +0100
            Re: session management Jørn Andersen <jorn@jorna.dk> - 2015-03-13 02:37 +0100
              Re: session management "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-03-13 02:54 +0100
          Re: session management Richard Damon <Richard@Damon-Family.org> - 2015-03-07 11:29 -0500
          Re: session management Erwin Moller <erwinmollerusenet@xs4all.nl> - 2015-03-09 11:29 +0100
      Re: session management "J.O. Aho" <user@example.net> - 2015-03-05 18:22 +0100
    Re: session management Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-03-06 11:33 +0100
  Re: session management Ben Bacarisse <ben.usenet@bsb.me.uk> - 2015-03-05 11:55 +0000

csiph-web