At 08:18 AM 12/2/2005, you wrote:
Hi,
I´m old to 4D programming, but very new to web-applications. This
time I have two questions.
I have a form where I have a password field. So the chars are hidden,
but they are then in the Url, when the user accepts the form. What to
do, to have this stuff not in the url??
Your form is using method="get". Try method="post". That said, I suspect
you are using HTTP and not HTTPS. Therefore, your passwords are still going
over the wire as clear text. If someone can sniff your traffic they can get
them.
In this form the user may subscribe to a service. I want to send him
a email to confirm that he is really the recipient. I have seen such
emails, and there are often long strings as key. What ways are there
to produce such long keynumbers or has everybody his own way??
There are many ways to do this. It depends on how long you want that key to
be.
That key is most likely encoded information about the user. Depending on
the information provided at signup you will might have already stored the
following in a [SIGNUP] table. You could also incorporate these fields into
a [USER] table.
user login name
user first name
user last name
signup datetimestampwithms (assuming you'll expire the signup if they don't
respond within N hours)
signupkey (I'll show you how to calculate this below)
You could hash various parts of this info. Because any hash may not contain
web-safe characters you'll either want to base64 or urlencode it.
So heres possible pseudocode to get your key.
$signupkey :=
base64(md5hash($loginname+$firstname+$lastname+$datetimestampwithms))
or if you want a longer one
$signupkey :=
base64(md5hash($loginname+$firstname+$lastname))+base64(md5hash($datetimestamp))
These will give you keys that would be very hard to guess.
The guesser would need to know all the info to build the key.
Using a datetimestamp with milliseconds makes it even more difficult.
You could also factor in a large random number if you want to make it even
harder to guess.
I can't remember off hand if Active4D has built-in base64 encoding and
md5hash routines. 4D can do base64 with the command IT_Encode.
hth,
Brad Perkins
Many thanks
Norbert
Norbert Pfaff
Mannheimer Str. 24b
67098 Bad Dürkheim
Fon: 06322 66185
_______________________________________________
Active4D-dev mailing list
[email protected]
http://mailman.aparajitaworld.com/mailman/listinfo/active4d-dev
Archives: http://mailman.aparajitaworld.com/archive/active4d-dev/
_______________________________________________
Active4D-dev mailing list
[email protected]
http://mailman.aparajitaworld.com/mailman/listinfo/active4d-dev
Archives: http://mailman.aparajitaworld.com/archive/active4d-dev/
