PHP and MySQL login routine security question?
I found this account login code online:
<?php
require_once('connect.php');
$email = mysql_escape_string(trim(stripslashes($_...
if (!empty($email)) {
$query = "SELECT username, password FROM members WHERE email = '$email'";
$result = mysql_query($query);
while ($row = mysql_fetch_object($result)) {
$username = $row->username;
$password = $row->password;
}
echo "Your username is $username";
echo "Your password is $password";
}
else {
echo "Please enter your email address!";
}
?>
My question is, isn't this very unsafe since if a malicious user does a little digging and finds a user's email address, they can pretty much get their password or am I incorrect? I have a mysql db and and trying to develop a secure php front end with user login. I haven't found any that use hashing algorythms.
|
Linear Mode
