[laytonsdad]

I am working out how to allow registered users who have forgot their password to change it.

Here is a diagram of what I think would work but I need some advise on if it is a good practice to do it this way.

[creativecoding]

yeah that way works. Don't use encryption though, use hashing.

[laytonsdad]

creativecoding, on 11 September 2012 - 04:49 PM, said:

yeah that way works. Don't use encryption though, use hashing.

When you say use hashing versus encryption what do you mean? I usually use sha1 is this a bad habit?

This post has been edited by laytonsdad: 11 September 2012 - 04:53 PM

[creativecoding]

Encryption and hashing are two different things. Encryption can be unencrypted. Hashes cannot.Things that are the same will have the same hash (much like encryption). sha1 is hashing, not encrypting. See my member title. And yes, sha1 should be enough but I usually use sha512.

This post has been edited by creativecoding: 11 September 2012 - 06:09 PM

[laytonsdad]

creativecoding, on 11 September 2012 - 06:08 PM, said:

Encryption and hashing are two different things.

I will remember this, I meant hashing when I wrote encryption.