Posted by Chris Shiflett on 11/09/43 11:31

Ben Ramsey wrote:
> $clean = array();
> $sql = array();

Glad to see someone spreading this habit. :-) Thanks, Ben.

> if (ctype_alnum($_POST['pass']))
> {
> $clean['pass'] = $_POST['pass'];
> }

I think it's fine to cheat a bit with the password and trust the output
format of md5():

$clean['pass'] = md5($_POST['pass']);

Of course, it is best to use a salt:

$salt = 'SHIFLETT';
$clean['pass'] = md5($salt . md5($_POST['pass'] . $salt));

Chris

--
Chris Shiflett
Brain Bulb, The PHP Consultancy
http://brainbulb.com/

[Back to original message]