Re: Re: Select and $_POST

From:	M	Date:	Thu, 10 Nov 2005 09:46:44 +0000
Subject:	Re: Re: Select and $_POST
References:	1 2 3	Groups:	php.general
Request:	Send a blank email to php-general+get-225499@lists.php.net to get a copy of this message

Chris Shiflett wrote:

Ben Ramsey wrote:
$clean = array(); $sql = array();
Glad to see someone spreading this habit. :-) Thanks, Ben.
if (ctype_alnum($_POST['pass'])) {
    $clean['pass'] = $_POST['pass'];
}
I think it's fine to cheat a bit with the password and trust the output format of md5():

$clean['pass'] = md5((ini_get('magic_quotes_gpc') ? stripslashes($_POST['pass']) : $_POST['pass'])); or users with quotes in their password won't be able to log in.

$clean['pass'] = md5($_POST['pass']); Of course, it is best to use a salt: $salt = 'SHIFLETT'; $clean['pass'] = md5($salt . md5($_POST['pass'] . $salt)); Chris