Topic: Login Script - Best Practice (Page 1 of 1)

Hey, just trying to tighten the security of a login script I wrote and been reading a lot of different scripts but couldn't really find the best practices. One thing I have noticed was that many scripts were varifying $_POST vars directly from post such as

SELECT * FROM eg WHERE user='$_POST[user]' AND pass='sha1/md5($_POST['pass'])'

just for example

I've always assigned the $_POST to a var first then varifying the var... is that not safe?

The example you gave is basically the worst possible practice.

quote:

---

Orion said:

I've always assigned the $_POST to a var first then varifying the var... is that not safe?

---

This is a better way.

Here's a good tutorial.

Also parameterized queries are a good practice. One Project - want to set up on multiple databases - where do I start

thanks arthurio, that's one of the articles/example I'm digging through right now, I'm combining about 4 different things right now but was really wondering about the grabbing of vars, thanks =)