note 51003 deleted from function.crypt by joey
| From: | joey@php.net | Date: | Mon, 27 Dec 2010 12:20:22 +0000 |
| Subject: | note 51003 deleted from function.crypt by joey | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-175229@lists.php.net to get a copy of this message | ||
Note Submitter: postal2600 at yahoo dot com
----
I'll take the example from above and take a situation that I've ecountered and show you
something that puts this function in a dark shadow of insecurity:
<?php
$password = crypt('postal2600','CyberBoard');
if (crypt('postal26??', $password) == $password) {
echo "Password verified!";
}
?>
Instad of ?? you can put anything an see that allway the password will be verified. So i strongly
recomand that the md5 function should be used instead.