note 14739 deleted from function.session-start by jimw
| From: | jimw@php.net | Date: | Fri, 07 Dec 2001 20:28:42 +0000 |
| Subject: | note 14739 deleted from function.session-start by jimw | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-21925@lists.php.net to get a copy of this message | ||
as a follow up to the security announces: you can never be to paranoid about your admin passwords /
accesss.
what I do is always hash any password with MD5, store it as a key, allong with (for admins) IP
protection. only certain hosts are allowed to admin a site, and any script must determine user
access rights from it's own stuff, not from user supplied info (meaning anything through
GET/POST and even cookies). I ussualy store that stuff in a SQL database for safe keeping. (with
encrypted passwords off course)