note 35747 added to function.md5

In respons to paj at pajhome dot org dot uk @ 21-May-2003 03:20: In many cases, there is only hash of password saved on server, so JavaScript script must return: md5(md5(password) + random) and server must compare it with md5(saved_md5 + random). However, it might be less secure then sending plain password. Let say someone gaind read only access to your database (it doesn't matter how he did it). With such access he can read each user's reacord so he knows each user username and hash of password. With that knowledge, all he must do to hack your site is connect to server, read the random number, calculate md5(hash_of_password_which_he_has_stolen + random) and send it to server. Be aware of this issue if you think your database is not secure enought. ---- Manual Page -- http://www.php.net/manual/en/function.md5.php Edit Note -- http://master.php.net/manage/user-notes.php?action=edit+35747 Delete Note -- http://master.php.net/manage/user-notes.php?action=delete+35747&report=yes Reject Note -- http://master.php.net/manage/user-notes.php?action=reject+35747&report=yes