02.06.2013 Views

Pro PHP and jQuery by Jason Lengstorf.pdf - Computer Science ...

Pro PHP and jQuery by Jason Lengstorf.pdf - Computer Science ...

Pro PHP and jQuery by Jason Lengstorf.pdf - Computer Science ...

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

212<br />

CHAPTER 6 ■ PASSWORD PROTECTION SENSITIVE ACTIONS AND AREAS<br />

As you can see, hashes of the word test don’t match up when passed separately; however, if you<br />

supply an existing salted hash of test, the same hash is produced. This way, even if two users have the<br />

same password, their stored hashes will be different, making it much more difficult for potential<br />

attackers to crack passwords.<br />

■ Note Bear in mind that no algorithm is 100% effective. However, using techniques like salted hashes makes it<br />

possible to reduce the possibility of an attack significantly.<br />

Creating a User to Test Administrative Access<br />

In order to test the administrative functions, you’ll need a username/password pair to exist in your users<br />

table. For simplicity, the username will be testuser, the password will be admin, <strong>and</strong> the email address<br />

will be admin@example.com. Keep in mind that this is not a secure password; it is being used for illustration<br />

purposes only, <strong>and</strong> it should be changed before you use it with any production scripts.<br />

Begin <strong>by</strong> generating a hash of the password, admin, which is easy using the test method<br />

testSaltedHash() <strong>and</strong> test.php. Add the following bold code to test.php to generate a salted hash of<br />

your test user’s password:<br />

<br />

Navigate to http://localhost/test.php, <strong>and</strong> you’ll see output similar to the following:<br />

Hash of "admin":<br />

a1645e41f29c45c46539192fe29627751e1838f7311eeb4<br />

Copy the hash, navigate to http://localhost/phpmyadmin, <strong>and</strong> then click the SQL tab. Execute the<br />

following query to insert a test user into the table:<br />

INSERT INTO `php-jquery_example`.`users`<br />

(`user_name`, `user_pass`, `user_email`)<br />

VALUES

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!