My first script ever , critisize !!
View Single Post
01-04-2008, 06:41 PM
Join Date: Jan 2008
Location: Herefordshire, United Kingdom
Apart from what is outputted to the front-end it is rather hard to review the script in to much depth. The lack of security is a rather large hole however in the general development as, without security, a script is a prime target for all sorts of attacks.
A few questions/advice about registration;
A major flaw that often crops up in new registration scripts in the lack of user input validation - by this I mean the expectation that the user is going to put in
what you want them too. For instance, with the 'Email' field, what if they don't put in a real email that follows name@domain or put in something completely different altogether! It's very important to check that the input information is valid.
It's always advisory to make sure your 'password' fields are set as type=password otherwise anyone looking over the shoulder knows exactly how to get in a make some havoc! Also users are much less willing to give passwords away to sites which don't hide them.
It's very important to tell the user what to do and what's going on - once I registered I was sent back to the login screen; does this mean I was successful? Did the system crash? I have no idea! Make sure to update the user as to what's going on throughout.
Database injections can be nasty stuff and without escaping your Db input alot you could be facing some major issues. Always make sure to addslashes() and if you don't want HTML outputting when you come to retrieve it use either strip_tags() or htmlentities() depending on the desired effect. Personally I go down the route of making a parsing class for all my Database Ins/Outs and $_GET's.
Just some small points that should hopefully help - generally it seems like a good work in progress so keep it up and if you want some further help post up some code and I'll take a look. (:
Bit of a nutty one!
| LedburyRd | CoffeeBean
The Following 2 Users Say Thank You to YouNeek For This Useful Post:
View Public Profile
Send a private message to YouNeek
Visit YouNeek's homepage!
Find More Posts by YouNeek