Re: Re: Beginners Problem

Could I recommend a more secure approach: 1) using two hashes to protect the data (in case the database is compromised they are both one-way hashes, and using two protects against collision attacks whereby a different password string generates the same hash as the original password) 2) escaping user input to protect against SQL injection attacks (nasty queries can get more data from the database than your original query intended, or change the query's intended functionality). Instead of: $chkuserquery = "SELECT userID FROM $TB_USERS WHERE loginID='$loginID' AND password='$password' LIMIT 1"; $chkuser = $db->query($chkuserquery); This example utilises the mdb2 database layer: $user_credentials = array( //these are the credentials the user supplied 'user_name' => addslashes($username), //escape username input 'user_password_md5' => md5($password), //generate hash, no injection is posisble 'user_password_sha1' => sha1($password) //due to 'scrambling' of string ); foreach ($user_credentials as $k => $v) { //build string $query_values .= $k . '=' . $db->quote(trim($v)) . ' AND '; } $query_values = '(' . substr($query_values, 0, -5) . ')'; //format string and remove AND $sql = "SELECT COUNT(user_id) AS user_count FROM user WHERE $query_values"; $result = $db->query($sql); //this if not only returns a row from the database query, it then checks if the user_count //field contains more than one or more results. if so, login is correct if (($row = $result->fetchRow(MDB2_FETCHMODE_ASSOC)) && $row['user_count']){ $valid_login = true; //session -> database etc } for this example, using 'root' and 'password', $query_values is: (user_name='root' AND user_password_md5='5f4dcc3b5aa765d61d8327deb882cf99' AND user_password_sha1='5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8') This code is identical in functionality to the previous example, except the query has no LIMIT - this is not required as it prevents the possibility of coding error handling for multiple accounts (perhaps unnecessary, excepting very secure applications). Andy