note 52022 added to function.crypt

>icecube at fr dot fm 07-Mar-2002 09:53 >To generate a .htaccess-based authentication with DES, >you have to use the first two characters of your password >as salt. This is a _really_ bad idea, seeing how the two first letters of your password will be reveiled, effectively reducing the quality of your password. Your example assigns "sonH/h2hpGtHk" to $ht_pass, where "so" of course are the first to letters in something. Try it out for yourself. Switching the password to "icecube" gives "ickJ.ZxzjXpNE" as the output. Get my point? The salt is always included in the encrypted string. Use a random salt instead. ---- Manual Page -- http://www.php.net/manual/en/function.crypt.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+52022 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+52022&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+52022&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+52022&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+52022&report=yes&reason=useless Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+52022&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+52022&report=yes Search -- http://master.php.net/manage/user-notes.php