Enhance the security of User Password Storage and Inspection

The following $ username and $ password respectively refer to the user name and password, and $ sitekey is the site scrambling code.

Password settings

<Input type = "password" name = "passwd"/>
<Input type = "hidden" name = "t_code0"/>

Use javascript for processing when submitting


T_code0.value = md5 (username. value "|" passwd. value );
Passwd. value = '';

If the submitted passwd has a value or t_code0 is null, the password setting fails;

The t_code0 value is saved to the save_pwd field of the database;


Password Verification

1. log on to the client
The server generates a random code $ sid, saves it to $ _ SESSION [sid], and passes it to the user;

Form


<Input type = "hidden" name = "sid" value = "..."/>
<Input name = "username"/>
<Input type = "password" name = "passwd"/>
<Input type = "hidden" name = "t_code"/>

2. the user enters the user name and password and uses javascript to process the submission.


Var t = md5 (username. value "|" passwd. value );
T_code.value = md5 (sid "|" t );
Passwd. value = '';
3. server-side Determination
If username is empty, passwd is not empty, or t_code is empty, return to the logon page;
If no $ _ SESSION [sid] exists, return to the logon page;


[Php]