
10-13-2011, 03:54 PM
|
|
team canada
|
 |
Join Date: Jul 2004
Location: Canada
Posts: 5,200
|
|
|
NEVER store raw passwords in databases.
Also your data isn't even escaped properly. Use format, escape, and float or int when you make queries. I.e:
temp.query = format("SELECT username FROM Users WHERE something = '%s' OR number = %s", provided_something.escape(), float(provided_number));
Passwords should be salted and hashed before inserted into the database. For that you need 3 columns:
username, password, salt
To "register" a user:
1. Generate a random salt:
temp.salt = md5(timevar2);
2. Hash the player's provided password with the salt:
temp.password = md5(salt @ provided_password @ salt);
3. Store the hashed password and salt in the database with the username.
To "login" a user:
1. Use a select statement to retrieve the username:
temp.query = format(SELECT username, password, salt
FROM Users
WHERE username = '%s', provided_username.escape());
2. Compare the hash like this:
if (user_password == md5(salt @ provided_password @ salt)) { // Success |
|
|
|