Keith Hall
Members
-
Joined
-
Last visited
-
Sorry I didn't get to reply earlier - but I see you got a good set of replies so looks like you're on track
-
Just an observation... If this is going to be used or accessible by more people than yourself, you may want to look at adding some SQL injection protection too rather than simply taking user-posted variables and inserting directly into the database... Pass each variable through an escaping mechanism first.
-
Nice article and interesting stuff, particularly about videos! Do you think there's any difference in terms of optimisation between 'html5' videos 'on site' and/or via links to Flash e.g. youtube? so there's two points there... html5/flash and on-site and off-site ??
-
That is why a salt is used Makes it practically impossible because whilst you may find a password which equates the stored hash, when you enter that password and the salt is added, it no longer matches.
-
Did you get help with this?
-
Have you already got data in the petdata table which may contradict the constraint? That's usually where the issue lies if everything else looks ok! Keith
-
And, may I add, in addition to always escaping the content before passing to the DB (read up on sql injection), whenever storing passwords, it would be sensible to at least md5 hash the password with some 'salt' so if there is any compromise of your database, people's passwords will not be open to the public... It's quite easy to do, certainly in PHP you can just do something like $hashedpw = md5("somesalt".$enteredpw); then you store the resulting $hashedpw in your database (it is not possible to reverse the process to get the password). When someone logs in, you simply run the same process and compare the hash with the one in the database, if they match, the right password was entered. The 'salt' is used to prevent a trick where someone can continously generate hashes with random content until the hash matches, then they can log in using that content as the password - using a salt negates this (as long as the salt is unknown to the hacker). Hope this helps - it's a similar process to how the authentication on Cloudware City is handled. Keith