GOOCODE - Find your code/scripts

0 When working with the Unicode character set, use the corresponding function instead of the native string function. For example, if a file is encoded as UTF-8 PHP code, if the strlen() function is wrong, use the mb_strlen() function instead.

If you use substr to intercept Chinese characters, garbled characters will appear, because substr is intercepted in bytes. That is, UTF-8 encoded Chinese, using substr interception, will only intercept 1/3 Chinese, of course, garbled. When UTF-8 is encoded, a Chinese character is 3 bytes. Similarly, different languages in other countries will produce multi-byte strings, so we use mb_strlen() to handle them.

0 Never know the user's password, we must encrypt the user's password, and can not save the user's original password directly in the database. Do not limit the user password format. If the format is specified, it may be exploited and cracked by the attacker. Of course, we need to limit the minimum length of the password. It is recommended to use at least 8 bits. The longer the better.

For password security, developers need to:
1, absolutely can not know the user's password, we must encrypt the user's password, can not save the user's original password directly in the database.
2, do not limit the user password format, if the format is specified, it is likely to be exploited and cracked by the attacker, of course, we need to limit the minimum length of the password, it is recommended to at least 8 bits, the longer the better.
3, can not send the user password through the mailbox, when we develop the application to retrieve the password, the user password is not notified to the user by email, but the link to reset the password is sent to the user in the form of mail, let the user Go to reset the password.