Re: Securing Forms???

From:	Gerard Samuel	Date:	Wed, 18 Aug 2004 23:17:53 +0000
Subject:	Re: Securing Forms???
References:	1 2 3 4 5	Groups:	php.general
Request:	Send a blank email to php-general+get-194214@lists.php.net to get a copy of this message

Peter Brodersen wrote:

On Wed, 18 Aug 2004 17:59:34 -0700, in php.general holmes072000@charter.net (John Holmes) wrote:
$token = md5(uniqid(rand(), true)); .. is a pretty bad idea, since the output could include quotes, newlines, low-ascii-characters, thereby messing up the form.
How do you figure that? md5() only returns 0-9 and a-f characters.
From the manual: http://php.net/md5 string md5 ( string str [, bool raw_output]) "If the optional raw_output is set to TRUE, then the md5 digest is instead returned in raw binary format with a length of 16."

Double check the example that I originally provided. -- md5( uniqid(rand(), true) ) -- Im not using the "raw_output" option of md5() md5( uniqid(rand(), true) )