Re: Securing Forms???
| From: | John Holmes | Date: | Thu, 19 Aug 2004 00:59:34 +0000 |
| Subject: | Re: Securing Forms??? | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-194196@lists.php.net to get a copy of this message | ||
Peter Brodersen wrote:
How do you figure that? md5() only returns 0-9 and a-f characters.http://shiflett.org/talks/oscon2004/php-security/36$token = md5(uniqid(rand(), true)); .. is a pretty bad idea, since the output could include quotes, newlines, low-ascii-characters, thereby messing up the form.
$token = md5(uniqid(rand() )); ought to be sufficient - and works with PHP4 :)Using entropy with uniqid() simply returns a more unique value to md5(), so what's the difference. -- ---John Holmes... Amazon Wishlist: www.amazon.com/o/registry/3BEXC84AB3A5E/ php|architect: The Magazine for PHP Professionals – www.phparch.com