I'm just doing this as part of a course to learn PHP, so it probably doesn't really matter anyway, but I'd like to have good habits from the start. I'm learning to create a CMS and I'm creating a page to edit user details. I have two password fields so the user has to re-type it, and they will be compared to see if they match.

 

I'm stuck on what to do with them. Should I compare the fields first, and if they match go on to password validation for one of them? Or should I pick a field (which though? Does it even matter?) and validate the password, then if there aren't any errors see if they match? At what point do I check that both fields are filled in? :/

Check if the fields match and then validate it.

Check if the fields match and then validate it.

 

Yeah, this is what I ended up doing in the meantime. Though I just don't know whether the user would be annoyed at having to type matching passwords only to find out they aren't long enough, or have other problems. Might be overthinking it though - I mean, it's not that difficult to type in another twice, is it?

 

Rallport -

Thanks. I wasn't sure about checking for numbers/symbols included, as I heard that doesn't really make passwords strong? I thought it was advised now that passwords should be more like random phrases?

 

Validate when the password was last changed

Would you mind explaining about this? Does it matter if the password has been recently changed?

 

Oh, and yes, I've learned about encryption It took a while to get my head around it. I haven't tried using the built in PHP functions yet.