Databases
StackOverflow2013
Postsdbo
PORegistration Security PHP
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PORegistration Security PHP
    primarykey
    data
    text
    <p>So i've been trying to make secure PHP login / registration scripts and so far without any kind of password encryption I have this:</p> <pre><code>if($_POST) { function GenericError() { echo '&lt;script type="text/javascript"&gt;window.location.href="error.php"&lt;/script&gt;'; } function CheckEmpty($param) { if($param == "" || $param == null) echo '&lt;script type="text/javascript"&gt;window.location.href="empty.php" &lt;/script&gt;'; } function AllYourBase() { mysql_connect("MyHost", "MyUsername", "MyPassword") or die(mysql_error()); mysql_select_db("MyDatabase") or die(mysql_error()); } $username = CheckEmpty($_POST['username']); $first = CheckEmpty($_POST['fname']); $last = CheckEmpty($_POST['lname']); if($_POST['password'] == $_POST['vpass']) $password = $_POST['password']; else echo '&lt;script type="text/javascript"&gt;window.location.href="pass.php"&lt;/script&gt;'; if($_POST['email'] == $_POST['vemail']) $email = $_POST['email']; else echo '&lt;script type="text/javascript"&gt;window.location.href="email.php"&lt;/script&gt;'; AllYourBase(); mysql_query("INSERT INTO Users (username, password, firstname, lastname, email) VALUES ('%s', '%s', '%s', '%s, '%s')", mysql_real_escape_string($username), mysql_real_escape_string($password), mysql_real_escape_string($first), mysql_real_escape_string($last), mysql_real_escape_string($email)) or die(GenericError()); echo '&lt;script type="text/javascript"&gt;window.location.href="win.php"&lt;/script&gt;'; } &lt;/pre&gt; </code></pre> <p>Does this seem right to you guys? Is there anything else I can do besides password encryption to make this more secure? Also, is there a better way to handle errors than making all these individual pages?</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USShandhanu Mohan
    1. USHowdy_McGee
    plurals
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. COYou don't need to encrypt passwords unless you need them back. Simple hashing (together with a random salt) will do.
      singulars
      1. PORegistration Security PHP
      1. USÁlvaro González
    2. COIf I do hash / salt - is it possible to decrypt them so for say I can add a "forgot password" button?
      singulars
      1. PORegistration Security PHP
      1. USHowdy_McGee
    3. CONo, you cannot decrypt (at least easily) a hash. That is the point. There are other password reset workflows.
      singulars
      1. PORegistration Security PHP
      1. USrcravens
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload