These are not PHP specific suggestions, but I see two big problems:

> 5.)     Password is then encrypted using base64_encode() 6.)     

You've confused encryption and encoding. Base64 encoding is trivial to decode, and 
obvious to spot as well. All this achieves is that someone can't accidentally - before 
avert their eyes - read the password while doing a "view source". But anyone who wants 
can get it if they're given the base64 encoded representation. I wouldn't use this 
method - or 
a website that did.

> 8.)     If No username is found, Message is sent to end user stating
> username does not exist. 

Don't tell them whether it was the username or the password that was wrong. Doing so 
a hacker decompose a complex problem into two simpler problems. With your method, I 
would first keep trying until you confirm that I've guessed a valid username, then I 
can go 
about guessing the password. If I don't know which is wrong, the number of 
possibilities is 
increased geometrically.  

Mike Morris
The Music Place
1617 Willowhurst Avenue
San Jose, CA 95125
(408) 445-ARTS (2787)
    Your Free Historical Quote:
        Finally, it is my most fervent prayer to that Almighty Being before whom I now 
        stand, and who has kept us in His hands from the infancy of our Republic to 
        present day, that He will so overrule all my intentions and actions and 
inspire the
        hearts of my fellow-citizens that we may be preserved from dangers of all 
        and continue forever a united and happy people.
                    - Andrew Jackson, Second Inaugural Address, March 4, 1833

PHP Database Mailing List (
To unsubscribe, visit:

Reply via email to