note 51004 deleted from function.crypt by nlopess
| From: | nlopess@php.net | Date: | Wed, 16 Mar 2005 15:17:21 +0000 |
| Subject: | note 51004 deleted from function.crypt by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-86560@lists.php.net to get a copy of this message | ||
Note Submitter: postal2600 at yahoo dot com
----
I'll take the example from above and take a situation that I've ecountered and show you
something that puts this function in a dark shadow of insecurity:
<?php
$password = crypt('postal2600','CyberBoard');
if (crypt('postal26??', $password) == $password) {
echo "Password verified!";
}
?>
Instead of ?? you can put anything an see that allway the password will be verified. So i strongly
recomand that the md5 function should be used instead.