Many developers particularly those who work in a LAMP environment use the password() function of mysql to encode the passwords that they store in their database. I am not talking even about mysql account password, but passwords as saved by authentication app. The password function is not supposed to be very secure but people use it anyway - in fact I have also been guilty of this crime at times.On the other hand I have seen $1000 applications that store the password in clear text. These poor losers argue that if someone gains unauthorized access to your database you are in big trouble anyway. That is not the point. Passwords should be one way hashed to protect them from friendly eyes as well as those of the intruders. You hear about passwords belonging to thousands of users being released on underground websites all the time. Most people use the same password on multiple sites if compromised once means compromised everywhere.No self respecting system administrator or DBA will want to take a peek at your password on purpose but sometimes when doing routine administration it's simply impossible not to see the contents of the password field if it's not encrypted - as they say lead us not into temptation.In any event <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.postgresql.org">postgres</a> does not have the same password() function that you find in mysql so you have to encode the password yourself. Now if we had all done things right the first time our PHP code would do the encryption for us instead of relying on the mysql function. Since programmers are lazy by nature it's not done that way.Changing your PHP script not to use the password function is is a simple task. You only need one line of code to create an MD5 hash in php - not so with java. Though it is said that you can program with java with little knowledge of what lies under the hood - cryptography is one exception. In this case it is PHP that hides all the gory details while java assumes that you would know how the internal combustion engine worked.March 23, 2023 update: MD5 has been considered insecure for a long time (I just didn't get around to updating this blog for many years)

Mysql , postgres and passwords

It seems my efforts to <a target="_blank" rel="noopener noreferrer nofollow" href="463.html">configure PHP 5 with java 5 support</a> was a complete and utter waste of time. <a target="_blank" rel="noopener noreferrer nofollow" href="422.html">Java 5 or any version of java</a>, for that matter cannot be used with <a target="_blank" rel="noopener noreferrer nofollow" href="../../php/php5.php">PHP 5</a>. It's perhaps more accurate to say the java extension for PHP 5 is conspicuous by it's absence.Since PHP 5 is said to be so much better than PHP 4 in every aspect I didn't bother to find out about the availability of the java extension before my efforts at installation. Last week' attempts to install PHP5 were unsuccesfull due to a <a target="_blank" rel="noopener noreferrer nofollow" href="307.html">conflict with turck mmcache</a>. However at the time I was working with a beta of PHP5. Yesterday I tried with the 'gold release' and managed to have it installed without any problems at all. However the java extension did not show up with a call to phpinfo();It was then that I examined the ext/ folder to find that the java extension is missing, then I thought it might be available at PECL but I was wrong again. Finally I did what I should have done right at the start; visited <a target="_blank" rel="noopener noreferrer nofollow" href="http://'www.zend.com/">zend.com</a> and did some reading only to find that the java extension has been 'temporarily' dropped from PHP 5.So much for the tremoundous improvements.

Java 5 and PHP 5 the verdict

I have managed to sucessfully download the J2SDK 1.5 (<a target="_blank" rel="noopener noreferrer nofollow" href="422.html">or is it jdk 5.0 ?</a>) at last. (Previous attempts resulted in a corrupted file). The file that I have in my hands is labeled jdk-1_5_0-beta2-linux-i586.bin so I am not sure why the installation instructions athttp://java.sun.com/j2se/1.5.0/install-linux.htmlshould refer to java 5.Update March 23, 2023 : those links to sun.com are no longer valid of course

Monthly Archives for 2004 07

Mysql , postgres and passwords

Java 5 and PHP 5 the verdict

Java 5 or 1.5? the plot thickens