Comments on: Simple Techniques to Lock Down your Website

By: Dustin

Dustin — Sat, 20 Mar 2010 22:50:39 +0000

What usually happens? I suppose requiring a user to provide their password to make certain changes would be required, right? So you require a password to change an e-mail, or even the old password etc, so that you can use that same information to re-construct the process.

By: andrew

andrew — Fri, 12 Mar 2010 23:46:04 +0000

I see you use the email in the hash for the password:

What happens if the user wishes to change their email?

By: speedy18us

speedy18us — Wed, 10 Mar 2010 07:24:31 +0000

I never saw such a complete tutorials on the web. I’ll read them all, ’cause I love them. Many thanks!

By: Dustin

Dustin — Tue, 02 Mar 2010 07:41:42 +0000

Very nice touch with the added timestamp.

By: Brad

Brad — Fri, 12 Feb 2010 21:47:55 +0000

For some reason there seem to be a lot of people here who didnt understand these were examples, not straight code to use on your site. To use this material you must understand it and then modify it for your use.

Getting beyond that, thanks for the tut. I am now using hash(sha512) on my sites salted with the time stamp at the time they registered. Yes its stored in the database, but you have to get past the sha512 hash to get to it.

Thanks again, well done.

By: Kingdutch

Kingdutch — Mon, 01 Feb 2010 15:58:47 +0000

I’m too lazy to read all the comments so I dunno if no one else posted it yet.

But am I the only one to notice in 3. Authenticating the user you actually only need a valid username? As your SQL never actually checks against the password? ^^

(You first use the username to get salt and e-mail and then match again just against the username)

By: Paul Chater

Paul Chater — Fri, 22 Jan 2010 23:39:49 +0000

I think that some people should really re-read and reiterate to themselves the title of this post, “SIMPLE” would be a key word. Haha.

I think now-a-days practically every coder knows that MD5 is indeed broke, and should use one of the SHA methods with salting. It’s interesting… Although I definitely wouldn’t recommend storing the string in the database. Heh that’s just askin’ for trouble in my eyes.

The way I encrypt is using an encryption key of a random string sha1-hashed, then hashing that hash again and using that hash as the salt and then hashing the actual users password with the salt appended. Personally I think it’s very secure haha, but I think I’d need a crypto-geek to tell me if it’s a highly secure way.

By: Dustin

Dustin — Fri, 27 Nov 2009 06:25:57 +0000

Thanks for the response, I show my errors when I’m developing a website, or a script, up until I make it available to the public, unless you intend to copy and paste this for you own implementations, yea, your gonna show MySQL errors unless you fix it yourself.

Yes I used MD5 as an example, I know MD5 is broken, I assume you had no intention to read commented code.

By: Karlos

Karlos — Fri, 20 Nov 2009 23:03:49 +0000

You show your MySql errors to the public??????? Surely this is one of the first lines of defense in securing your database and website scripting. Im shocked.

mysql_connect($db_host, $db_usr, $db_pass) or die(“MySQL Error: ” . mysql_error());

You also use md5 in one of your scripts. This is now broken and no longer presumed industry standard.

And the below line is unecessary as you could just use the MySql respose to identify if theres a matched record.
if(mysql_num_rows($checklogin) == 1)

By: Kevin Jensen

Kevin Jensen — Thu, 12 Nov 2009 06:47:29 +0000

I want to see this tutorial on how to stop phishing. That will be a good one.