afterburn

I would like to add to the above post.

Do not store passwords either. Use only 1 part of the key or an key that does not matter on the username/password.

like creating an Guid for UserId and using that as the cookie value rather than the username. It will limit the surface area of the database to what you expose rather than what the client has. Doing it this will prohibit brute force attacks to a minium.

__________________
ASP.net nice bits
Code Smith rocking tool for Code Generation in any language (Written in .net)
Red Gate SQL tools for DBA
Blog Personal blog
.afterburn

nealbo

I can't use sessions or cookies for this specific part of my script because it's for users to view the stats of other users. There's no important information, just how well they're doing in certain computer games etc so theres no chance of a security risk.
And as for the password bit, I have that stored with my database, and within cookies with some sort of encryption (can't remember what, but I got it from a very good tutorial) but I think that thats safe, isn't it?
Thanks for the warnings, and I'll definately take them on board for any future projects I might do with a more serious tone, which'll probably never happen
Anyways, once again thanks for the help everyone!