View Single Post
  #2  
Old 10-13-2011, 03:54 PM
fowlplay4 fowlplay4 is offline
team canada
fowlplay4's Avatar
Join Date: Jul 2004
Location: Canada
Posts: 5,200
fowlplay4 has a reputation beyond reputefowlplay4 has a reputation beyond reputefowlplay4 has a reputation beyond reputefowlplay4 has a reputation beyond reputefowlplay4 has a reputation beyond reputefowlplay4 has a reputation beyond reputefowlplay4 has a reputation beyond reputefowlplay4 has a reputation beyond reputefowlplay4 has a reputation beyond reputefowlplay4 has a reputation beyond reputefowlplay4 has a reputation beyond repute
NEVER store raw passwords in databases.

Also your data isn't even escaped properly. Use format, escape, and float or int when you make queries. I.e:

temp.query = format("SELECT username FROM Users WHERE something = '%s' OR number = %s", provided_something.escape(), float(provided_number));

Passwords should be salted and hashed before inserted into the database. For that you need 3 columns:

username, password, salt

To "register" a user:
1. Generate a random salt:
temp.salt = md5(timevar2);

2. Hash the player's provided password with the salt:
temp.password = md5(salt @ provided_password @ salt);

3. Store the hashed password and salt in the database with the username.

To "login" a user:

1. Use a select statement to retrieve the username:
temp.query = format(SELECT username, password, salt
FROM Users
WHERE username = '%s', provided_username.escape());

2. Compare the hash like this:
if (user_password == md5(salt @ provided_password @ salt)) { // Success
__________________
Quote:
Reply With Quote