33 votes

Login form C# SQL

SQL Injection alarm Don't use user passed text in your sql statements if you aren't using parameters. From: https://stackoverflow.com/a/7505842/2655508 Using parameters helps prevent SQL Injection ...
  • 50k
18 votes

Login form C# SQL

Cleartext passwords Not a code-specific issue exactly but it would appear that you are storing the user's passwords in clear text. This means that anyone gaining access to the LOGIN_Tab would be ...
18 votes
Accepted

Is my PHP login system following best practices? Is the code really OOP?

This is a pretty good attempt at a login system. The code looks much better than 99% of code that I see on Stack Overflow. Keep up the good work! Your code is almost clean. Your classes do so little ...
  • 859
16 votes

Login form C# SQL

In addition to Heslacher's answer I would also look at the using statement. It is very important to keep a handle on resources like Sql Connections to ensure they ...
  • 439
15 votes
Accepted

PHP login based on a password parameter

This is not secure at all. Apart from the GET issue (use POST) and the hashing issue (use bcrypt) already mentioned, and the ...
  • 24.9k
14 votes

PHP OOP Login Class

Yes, there are several things I can see with your implementation, from most critical to less critical: SQL Injection - You has it! Since you're already using mysqli, learn about prepared statements ...
13 votes
Accepted

Simple login system using Python Flask and MySQL

Style Python has a style guide. It's called PEP8, and normally if you follow it you get easier to read code. It's a fairly small read, and you can learn some new things from it. It's recommended in ...
  • 41.7k
12 votes
Accepted

Basic OS login program

Never write login code This is much harder than you think. Leave it to the experts you will get some security piece wrong. Code Review Don't use this: ...
  • 92.1k
12 votes

Login form C# SQL

Security issues are covered, so just a bit on the code itself. You have three nearly identical pieces of code, inside a switch-statement. That seems to be a code-smell. Apart from that, I'm missing a ...
  • 396
11 votes

Comments in PHP authentication system

Is my code properly commented? No. You're documenting methods where they are used (usually multiple places) as opposed to where they are declared (inherently only one place): ...
  • 110k
11 votes

Iteration of password hashing in PHP

I'm no expert on security, but I believe this is not current best practice. I'll copy from an another answer of mine. Cryptographic Right Answers (2009, Colin Percival, author of scrypt) Password ...
  • 16.2k
11 votes
Accepted

Python username and password program

A few points: You can simplify the if loop by using the else condition. Getting input should be at the beginning of the ...
  • 432
10 votes
Accepted

A Simple, One-Page PHP Admin Login (with prepared SQL statements)

Security I'm not all that comfortable with echoing unsanitized user input: echo '<form action=' . $_SERVER['REQUEST_URI'] . ' method = "post">';. I did not ...
  • 24.9k
10 votes
Accepted

One way encoding a password

Reinventing the wheel Please note that encryption should, in principle, always be two way. A 'one way encryption' just sounds weird. Normally something is encrypted with the intention to decrypt it ...
10 votes

Creating Original Database Algorithm--Login System

It looks like passwords are stored in plain text form in the pswd.txt file. Never ever store passwords in plain text form. Store passwords salted and cryptographically hashed. That way, if an attacker ...
  • 110k
10 votes
Accepted

Simple SSH bruteforcer in Ruby

target = ARGV[0].to_s user = ARGV[1].to_s wordlist_file=ARGV[2].to_s Aren't those Strings already? ...
  • 897
10 votes
Accepted

PHP-MySQL sign-in and sign-up project

Security There are quite a lot of beginners mistakes in your code. While there aren't any serious security issues right now, it does contain a whole bunch of bad practices which will sooner or later ...
  • 24.9k
10 votes

Login form C# SQL

using as already covered SQL injection as already covered For getting a single row Reader is more efficient than ...
  • 5,930
10 votes
Accepted

PHP Login System with persistent login

Ok, moving down the list... I would separate the content of the includes folder into 2 semantically named folders: includes and ...
9 votes
Accepted

PHP OOP Login Class

Madara Uchiha sums up some problems. Here are some more: Too many if conditions A methods containing multiple if's smells. It makes testing harder since there are ...
  • 2,950
9 votes
Accepted

PDO Login/Register system I've been working on

First of, good luck with your interview! Over thinking and not thinking enough Writing code is easy, but writing code that will last longer then a minute is hard. You obviously know how to code. And ...
  • 2,950
9 votes
Accepted

Checking two text field for match and checking for null

Your indentation is a bit wonky. Why is the first line indented? Why isn't the stuff in the inner-else indented correctly? There's no reason to println() our ...
  • 25.2k
9 votes

PHP login based on a password parameter

Checking passwords / sending passwords via $_GET (in URL) as a absolutely nogo. You have to send that credentials via $_POST, ...
9 votes
Accepted

User registration and login program

Use C++ headers instead of C headers. Change #include <stdlib.h> to #include <cstdlib>. You could actually remove ...
9 votes

Simple login page

✔ Binding parameters You're using a database API and successfully binding your parameters. This will prevent SQL injection. ✘ No character white-lists Since you're outputting user input (ie: ...
  • 336
8 votes

Configure AspNet.Identity to allow for either username OR email address on login

I added some formatting to that nested ternery to try to understand what it's doing, and it still took me a while! ...
  • 5,714
8 votes
Accepted

Creating Original Database Algorithm--Login System

In your function pick_password, you should close the file at the end of the file because this frees up any system resources that were being devoted to working with ...
  • 13.2k
7 votes
Accepted

Complex if statements in authentication method

Use Guard Expressions The proper way to do this is to use Guard expressions. If you have a number of conditions that need to be true before you take an action. You don't check them all in a nested ...
  • 16.4k
7 votes

Complex if statements in authentication method

Two suggestions on how to keep this code maintainable: use early exits keep conditions atomic (one if checks for one thing) Example: ...
  • 536
7 votes

Efficiency with strcpy, strcat and malloc

Fairly good C. Few notes: sizeof(char) is by 1 definition. It doesn't hurt to multiply by it, but still totally unnecessary. ...
  • 54.1k

Only top scored, non community-wiki answers of a minimum length are eligible