Re: Securing Forms???
| From: | (Jennifer Goodie) | Date: | Wed, 18 Aug 2004 22:56:59 +0000 |
| Subject: | Re: Securing Forms??? | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-194207@lists.php.net to get a copy of this message | ||
> >> $token = md5(uniqid(rand(), true));
> >>
> >> .. is a pretty bad idea, since the output could include quotes,
> >> newlines, low-ascii-characters, thereby messing up the form.
> >How do you figure that? md5() only returns 0-9 and a-f characters.
>
> From the manual: http://php.net/md5
> string md5 ( string str [, bool raw_output])
> "If the optional raw_output is set to TRUE, then the md5 digest is
> instead returned in raw binary format with a length of 16."
The true is the second argument (more_entropy) for uniqid.