Re: [cobalt-users] 250 site limit URGENT HELP REQUIRED

[jens@xxxxxxxxxxxxxxxxxxxx (Jens Kristian Søgaard)]

"Mike Fritsch" <mfritsch@xxxxxxxxxxxx> writes:

> ereg() and verify EVERY input from your users make sure EVERYTHING is
> compatible and work, can't bug down the server

No, that's really not the best way to do it.

Besides that ereg() is a very slow function, it is also a general rule
in security to use "positive" lists, and not "negative" lists.

I.e. say "The user may enter A, B or C here".

Not "The user may NOT enter XYZ here".

> use encryption and a database backend...

Encryption is not a solution to all problems.


BTW: I would recommend you all to read Bruce Schneier's new book
"Secrets and Lies". It gives even "business-types" a great
introduction to Digital Security.


-- 
Jens Kristian Søgaard, Mermaid Consulting I/S,
jens@xxxxxxxxxxxxxxxxxxxx,
http://www.mermaidconsulting.com/