login username from database

Thread view:

Trev - 17 May 2007 19:45 GMT

Hi,

I have a login window with a username and password fields. The
program checks the username and password from a mysql DB table. If I
enter a username that is not in the database, how do I get it to
display a message that the username does not exist.

Thanks
Trevor

Reply to this Message

Richard Reynolds - 17 May 2007 21:24 GMT

> Hi,
>
[quoted text clipped - 5 lines]
> Thanks
> Trevor

JOptionPane?

Reply to this Message

rossum - 18 May 2007 01:42 GMT

>Hi,
>
[quoted text clipped - 5 lines]
>Thanks
>Trevor

That is insecure, you are giving out more information than needed.
Just say "Invalid username/password" so any attacker does not know
whether it is the username, the password or both that failed. This
makes it more difficult for them to try all possible combinations.

rossum

Reply to this Message

Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...