Renegade — Wed, 26 Mar 2003 10:03:53 +0000

Not a problem nuke

nuk3 — Wed, 26 Mar 2003 07:51:34 +0000

Quote: Originally posted by Renegade
Here's a link you might find useful

Thanks for that link Renegade. I think I'll be able to get the login script up and running with the help of that tutorial.

Cog — Wed, 26 Mar 2003 05:18:19 +0000

I'm working on a script that will do either all the work for you or the main bulk of it.

http://usermanage.sourceforge.net/

Mark Hensler — Mon, 24 Mar 2003 17:46:07 +0000

MD5 is simply an encryption method (not specific to mySQL). There is a mySQL function (conveniently called MD5) which will encrypt data with the MD5 algorythm. Same for SHA1.

PASSWORD() is specific to mySQL.

Suzanne — Mon, 24 Mar 2003 16:28:15 +0000

Oh, so MD5 is MySQL, too. Got it. While reading around, people were discussing them without specifying which went with what language.

Thanks for the links guys, this is great. I keep reaping the benefits of other people asking questions, lol.

Renegade — Mon, 24 Mar 2003 08:02:35 +0000

Here's a link you might find useful

Mark Hensler — Mon, 24 Mar 2003 06:43:37 +0000

depends on your application..

Quote: quoted from here: http://www.mysql.com/doc/en/Miscellaneous_functions.html#IDX1334

PASSWORD() encryption is non-reversible. PASSWORD() does not perform password encryption in the same way that Unix passwords are encrypted. See ENCRYPT(). Note: The PASSWORD() function is used by the authentication system in MySQL Server, you should NOT use it in your own applications. For that purpose, use MD5() or SHA1() instead. Also see RFC-2195 for more information about handling passwords and authentication securely in your application.

Sounds like good enough advice for me.

Suzanne — Mon, 24 Mar 2003 06:17:23 +0000

On topic, is there an opinion out there regarding whether it's better to use PHP -- mcrypt, md5 (?) -- or MySQL -- PASSWORD()?

nuk3 — Mon, 24 Mar 2003 05:51:28 +0000

Thanks for your help samsm

samsm — Sun, 23 Mar 2003 17:44:58 +0000

I posted something like this on another forum awhile ago. The answer I got back was: "Make one yourself!"

Well, I wanted unlimited, multidimensional hierarchies so I am actually still working on completing that project.

However, they are correct in that making a basic login script is pretty easy. I could attempt a step-by-step if you wanted.

Heck, I'll write up a basic one right now:
1. Start session
2. If logged in user valiable exits (5) else (3)
3. Present log-in form. User submits data.
4. Check data against records. If valid, store username and such in a session variable. Goto (1)
5. Logged in, cool!

The biggest security pitfall in PHP is relying upon registered global varaibles. This article explains that issue pretty well: http://www.sitepoint.com/article/758