note 70019 deleted from function.md5 by bjori
| From: | bjori@php.net | Date: | Sat, 30 Sep 2006 00:11:00 +0000 |
| Subject: | note 70019 deleted from function.md5 by bjori | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-117867@lists.php.net to get a copy of this message | ||
Note Submitter: sorin dot roiban at usphp dot com
Reason: in docs
----
When checking credentials against a database where you keep passwords hashed it is more secure to
create a query with the password hash instead of the actual password. One reason is that we
don't want the password to show up in clear in the database query log.
Use:
$hash = md5($password);
$query = "SELECT * FROM
Users WHERE UserId = '$id' AND
PasswordHash = '$hash'";
...
Do not use:
$query = "SELECT * FROM Users WHERE UserId = '$id' AND
PasswordHash = MD5('$password')";
...