note 51041 deleted from security.database.storage by joey

Note Submitter: Jim Plush - jiminoc at gmail dot com ---- Another handy trick is to use MD5 with a "salt". Which basically means appending another static string to your $password variable to help prevent against dictionary attacks. Example: config.php - KEEP THIS OUTSIDE THE WEBROOT define("PHP_SALT", "iLov3pHp5"); ---------------------------------------------- and when you add your database query you would do: // storing password hash $query = sprintf("INSERT INTO users(name,pwd) VALUES('%s','%s');", addslashes($username), md5($password.PHP_SALT)); This way if a user's password is "DOG" it can't be guessed easily because their password gets saved to the DB as the MD5 version of "DOGiLov3pHp5". Last time I checked, that wasn't in the dictionary :)