RE: [PHP] Follow up - PHP Security problems

Could you hold the verification data in a session ? If the verification process happens http then you could lock the cheksum server side with a session. ? __________ Matthew Luchak Webmaster Kaydara Inc. mluchak@kaydara.com -----Original Message----- From: Brent Rieck [mailto:bsr@spek.org] Sent: Wednesday, November 07, 2001 2:25 PM To: php-general@lists.php.net Subject: Re: [PHP] Follow up - PHP Security problems On Wed, 2001-11-07 at 10:21, DL Neil wrote: > if our less-than-friendly miscreant changed his email-reading program it would see the tag <img > src="ImgFile.php3?img=102342143"> and not bother with the image itself IF the 102342143 part conveys meaning (in > relation to your site registration). The img value could have meaning - and in fact should have meaning. It's meaning (amongst other things, this is only one example) could be the index into a database table that would contain the secret information that would be displayed in the middle of a graphic. It's the "username" (in this strained analogy) to the "password" contained within the graphic. Imagine a system where you could login by password only - given a sufficient number of users I bet I could log in on the first or second try. Pair the password with a username and you've got a signifigantly more difficult to break login system. --Brent bsr@spek.org -- www.spek.org -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net For additional commands, e-mail: php-general-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net