note 56776 added to function.md5

Re: Helpful Harry's code This code is not any less secure PROVIDED the attacker has to go through the pw_check() function to do the comparison. In other words if they are brute-forcing by submitting to your login validation code then there is no problem. HOWEVER, if they have gained access to the stored hash values by some means they may well be able to figure out that the END of the hashed string contains the START of the plaintext string (which is quite likely given the technique has been posted to such a visible forum, but would be feasible even if it hadn't). With this knowledge, it is _significantly_ easier to derive the rest of the password, strip off the seed and use it to log into your system. ---- Manual Page -- http://www.php.net/manual/en/function.md5.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+56776 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+56776&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+56776&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+56776&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+56776&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+56776&report=yes&reason=non-english Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+56776&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+56776&report=yes Search -- http://master.php.net/manage/user-notes.php