Re: Follow up - PHP Security problems

On Wed, 2001-11-07 at 10:21, DL Neil wrote: > if our less-than-friendly miscreant changed his email-reading program it would see the tag > <img > src="ImgFile.php3?img=102342143"> and not bother with the image itself IF the > 102342143 part conveys meaning (in > relation to your site registration). The img value could have meaning - and in fact should have meaning. It's meaning (amongst other things, this is only one example) could be the index into a database table that would contain the secret information that would be displayed in the middle of a graphic. It's the "username" (in this strained analogy) to the "password" contained within the graphic. Imagine a system where you could login by password only - given a sufficient number of users I bet I could log in on the first or second try. Pair the password with a username and you've got a signifigantly more difficult to break login system. --Brent bsr@spek.org -- www.spek.org