Re: authorization idea (good or bad?)
| From: | Michael T. Babcock | Date: | Wed, 04 Oct 2000 17:45:12 +0000 |
| Subject: | Re: authorization idea (good or bad?) | ||
| References: | 1 | Groups: | php.db |
| Request: | Send a blank email to php-db+get-3321@lists.php.net to get a copy of this message | ||
> At any rate, I've seen enough arguments against this idea to settle on
> username and password only...and I am only going to compare the md5 hash
of
> the username and password, not cleartext.
Don't forget that the password is still sent in cleartext across the
Internet before your PHP program ever sees it to compare it with MD5. It
may be stored on your server in hashed format, but its still cleartext on
the Internet.