security

I got headche while searching for a filter to encrypt/hide email cck field to protect email addresses from spambots. I have installed , deinstalled, activated-deactivated rearranged input filters with both invisimail and spamspan but no luck! Finally I decide to change code in email.module. It works! Go and open "sites/all/modules/email/email.module" and find the line 115 like this:

/**
 * Theme function for 'default' email field formatter.
 */
function theme_email_formatter_default($element) {

You can show password strength to your visitors while typing before even submitting the page to the webserver. There are four character groups: letters, caps, numbers and symbols. A password which is longer than 7 characters and contains at least one character from each group is strong vz537gnjua. A password which is at least 8 character long and has all characters from one group is weak (but not very weak). A password which contains all characters from one group and at least 20 characters long is also strong.

If your webhosting turned register-globals off and you are still using a script/software which requires register-globals on you have a problem. But there is an easy solution: Just put this code at the top of your php script(s). Attention!!! "register_globals=on" means a huge security risk. Do not turn it on unless you know what are you doing!
Technorati Profile

foreach(array($_GET, $_POST, $_COOKIE) as $k=>$v){
	foreach($v as $k2=>$v2){
		$$k2 = $v2;
	}
}

Now there are multiple captcha types against spam/abuse:

image captcha
ascii captcha
audio captcha
math captcha
easy questions

How will next generation captchas look like? I think in the future there will be much more captchas types like:

car captcha
film captcha
famous people
famous places
number to text
word suggestion with add remove extra letters(ie: gogle, new yoork)
animals (ie: which animals do you see in this picture from left to right)
traffic captcha

What do you think what more could be one of next spam-preventing technologies?

Password Validation with PHP and Regular Expressions

What is a good password? Your birthday, favorite star or first school, car, ...? None of them, because all similar passwords are very easy to crack.

My golden rule for safe-passwords is simple: Google or any search engine should NOT find any result for your password-string. But do not search for your password without changing some characters, because it will be visible as clear-text to all networks between your pc and Google server.

1. Brute force dedection should be enabled.
2. Cache directories should be secured.
3. Captcha's should be enabled and required for anonym users to avoid spam.
4. Code Injection should be prevented.
5. Cookies should NOT be used to store passwords and sensitive data.
6. CSRF should be prevented.
7. Directory listing should be disabled.