Comments on your approach
The most obvious thing to me is that you're already inserting all of your data into the temp table; why not just join to it? You can dynamically pivot into a better, strongly-typed table instead (see this post), and then you don't need to muck around with the parameter stuff.
I also think I think you're overcomplicating this by a ...
In regards to security for yourself, I would be using filter_var() to sanitize any input strings. Mainly the name and text inputs; If its a major concern or for your own sanity you could go as far as adding a preg_match($regex, $string) condition to check for characters you just don't want in those inputs.
For your passwords and user security I strongly ...
I did some testing and research on this, AFAIK your script is safe.
However, you should also be aware of how you retrieve the input. For example, what if the String contained a ", followed by executing PHP code. This would be an even worse vulnerability than malicious client-side code.
This post states old versions of IE may be vulnerable if your char-set ...
var ajax = new XMLHttpRequest();
ajax.open('POST', 'ajax.php?action=submit_form', true);
You can replace XHR with fetch. While XHR is widely supported, fetch is easier to work with. It uses promises instead of callbacks, which means you can readily use async/await with it. It's inspired from jQuery's $.ajax(). So if you're familiar with that, fetch will ...
I don't understand why encryption would be "hard" - the code above looks straightforward enough although I'm not sure you need the padding (never tried the new crypto APIs).
Do note that if you want to secure your UUIDs (why?), you probably want to add a random IV to your UUIDs otherwise you'll probably expose too much information - UUIDs have some bits ...
I'll attempt to make two points:
Differentiate where Strings are held in a pool; and,
Evaluate the code-duration where the sting value is held (i.e. start-to-finish number lines of code).
Since Java 11 (if I recall correctly), all strings not using Unicode are byte arrays. So the discussion should be about whether the reference to a string is shared (...
public static class Hashing
public static int SaltSize = 32;
This is public, static, and not const or readonly. That means:
"Anyone" can change it.
It's not thread-safe.
Hash validation is undermined.
I see no reason for it to be public, and every reason for it to be readonly or const. Personally I'd favour readonly and initialised from ...
You should obfuscate the equality check return combinedHash.Equals(serverHash); using a SlowEquals implementation.
Khalid Abuhakmeh's post explains the vulnerability.
/// Compares two byte arrays in length-constant time. This comparison
/// method is used so that password hashes cannot be extracted from