Shaun Childerley

Good, At least we know the owner of that website is an utter idiot.

Sorry, May have a misunderstanding, I have got the impression that you are setting a random password within the actual HTML form.

Just a side note, You posted this script on behalf of "www.flashbuilding.com", If you use this, I now know how to hijack the sessions. You created yourself another security risk posting the domain name and not only that, People on Google will also see.

This would be a bad example for the reason that a robot could easily set its own password and use it to login therefore defeating the point of having a random password. Use the script provided above or your own and as the registration is processed, generate the password within the php and store it in your password column.

<?php //Password generator function genPassword($len) { //Arrays of characters $numbers = array(0,1,2,3,4,5,6,7,8,9); $letters = array('a','b','c','d','e','f','g','h','i','j','k','l','m','n','o', 'p', 'q', 'r','s','t','u','v','w','x','y','z'); $symbols = array('[',']','{','}','#','@',':',';','>','<','/','*','(',')','-','+','=','~','!','"','%','|','.',','); $password = array(); //Generate password while(count($password) <= $len) { $option = array( $password[] = $numbers[rand(0, count($numbers)-1)], $password[] = $letters[rand(0, count($letters)-1)], $password[] = $symbols[rand(0, count($symbols)-1)]); rand(0, 2); } //Prepare and print password $password = implode('', $password); print $password; } genPassword(20); ?> I written this a while back, This is a proper password generator!

Yes, You could also create a function do filter, like this: function filter($input) { return mysql_real_escape_string($input): } Then wrap it around any $_POST or $_GET tag.

Wrap it around $_POST or $_GET or $_REQUEST, It should be around anything that accepts user input.

Wrap your $_POST with "mysql_real_escape_string()" or use PHP.NET to find and learn about the function. To prevent XSS attacks, use "html_entities()" or "strip_tags()" - Shaun

Hello, This contact form is on sale for £2, Theres some good reviews but not alot of sales. Im giving everyone the option to download and use for free on any terms, If you have a few quid spare and want to donate it feel free, If you don't that's fine also Paypal: sdchilderley[@]googlemail.com If you find any bugs with this contact form please PM me with the details and I will release updates.

This script is vulnerable to SQL Injection/XSS. You should set your ID field to "autoincrement" that way it can be used as a reliable source to find the user, What do you mean edit the ID so its equal to 5?

LOL it kinda defines the point of having DOCUMENTATION located at PHP.NET!

Well this is pointless, any idiot knows to visit php.net/scandir where it can be explained better.

Hello, Majority of us have built admin panel/control centres for our applications and software many times before, I want to discuss what practices other people use to protect there control panel such as what type of authentication do they use? Do they have a team that use the admin panel? If so what policy do they have in place to make sure a team member could not delete the entire database. - Type of authentication, Such as lockout times, SSL and so forth? - Do you log events such as members/customers being edited? - Do you moderate the changes made by your team? - Shaun

Yh to be onist its best practice that way everything is covered as you never know.

Im not that sure filter_var would make a difference lol, unless you found something i dont know?