Re: Member Script?

Originally Posted by
nintynet73
And it uses the deprecated eregi_ functions! And it's about as insecure as it can be, given that unsalted MD5 is only very slightly better than storing passwords in plain text! And it unnecessarily restricts values users can use as a password/passphrase! And it is vulnerable to SQL injection attacks!
You might want to take a look at this thread to see what the potential problems are, and why you need to worry about them even if your site isn't really that important in the grand scheme of things. And despite my criticism of the whole mailing-the-password thing, callumacrae's authentication script (linked in that thread) is a hugely better system than the ones pointed to above.
“Beware of bugs in the above code; I have only proved it correct, not tried it.” --Donald Knuth
"It was as if its architects were given a perfectly good hammer and gleefully replied, 'neat! With this hammer, we can build a tool that can pound in nails.'" -- Alex Papadimoulis (on TheDailyWTF.com)