Building Browsergames - Latest Comments in Building Browsergames: Securing our hashes (PHP)

Re: Building Browsergames: Securing our hashes (PHP)

MrLollige — Sat, 14 Mar 2009 14:05:48 -0000

Ah ok :).
Anyway, my salt (which I made before I read this thanks to the user comments on other pages) is short, and I probably do not need it anywhere else than on the login and register page.
Thanks for your reply!

Re: Building Browsergames: Securing our hashes (PHP)

bbgames — Sat, 14 Mar 2009 13:12:13 -0000

The benefits of turning it into a configuration value aren't so much in
securing it, as they are in not repeating it everywhere - if your salt is
'thequickbrownfoxjumpedoverthelazydog', do you really want to type that
everytime you need it?

Re: Building Browsergames: Securing our hashes (PHP)

MrLollige — Sat, 14 Mar 2009 12:13:10 -0000

you could(and probably should) turn the salt into a configuration parameter

Why? I mean, if I change the salt value (if someone figured it and modified his dictionary to it), noone would be able to login any more....

Re: Building Browsergames: Securing our hashes (PHP)

Chris Hepner — Sun, 30 Nov 2008 19:08:12 -0000

It doesn't matter much, but it isn't necessary to nest the md5() function within mysql_real_escape_string() as you will never have to escape a hexadecimal string.

While it usually works regardless, HTTP/1.1 requires you to use an absolute URL in header redirects. Example from php manual below:

/* Redirect to a different page in the current directory that was requested */
$host = $_SERVER['HTTP_HOST'];
$uri = rtrim(dirname($_SERVER['PHP_SELF']), '/\\');
$extra = 'mypage.php';
header("Location: http://$host$uri/$extra");
exit();