4 ms·
usr.Password = codify.SHA(pass) In modern code examples, please don't do things like just SHA plaintext passwords. Someone might copy it verbatim! Why not repl
by carbocation 12y ago
usr.Password = codify.SHA(pass)
In modern code examples, please don't do things like just SHA plaintext passwords. Someone might copy it verbatim! Why not replace that with:
import "code.google.com/p/go.crypto/bcrypt"
User := (... code pulling down the user account by username)
err = bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password))
if err != nil {
// invalid, password didn't match
}
- revelation 12y agoAlso, please don't tell people to write user input sanitation functions to fix SQL injections. Tell people to use a proper interface to their database that doesn't mix commands with data.
- tptacek 12y agoThat is good advice as far as it goes, but even with parameterized queries, there are "parameters" to queries that can't be "parameterized", and so sanitization of some sort is usually required. A hobby horse of mine is reminding people that it's dangerous do rely exclusively on parameterized queries.
- wglb 12y agoActually, I do tell them that. The reason is that if you are building a very dynamic web application in which the user's input or existing database values are used, for example, to determine a column name, table name, or even a database name, very strong whitelisting is required. For the other cases, paramaterization can take care of it.