Take the 2-minute tour ×

With security in mind, I implemented Mozilla Persona into my website for several reasons, mainly 'cause I'm too lazy to build up the database, I don't know how to properly secure it, and I don't feel like being blamed for user data theft.

I've posted several questions here, and on a lot of them, I'm posting data from a web form and putting it into PHP, querying it directly injected into a query variable. I've had my hand slapped for this, and I do know better, I just don't know how (which is again why I've chosen to use Persona).

The problem I'm running into is that Mozilla Persona doesn't really send you any info other than the email address, so I've decided to make a MySql table containing a User ID, email, and name of every user.

But how do I query this?

Long question made short, I need an opinion about how to properly request an email address via SQL; do I try to encrypt/salt (MD5) it or do I just put it into the query?

share|improve this question
I've never heard of encrypting or hashing email addresses. Usually passwords are salted / hashed, which works well because you never actually need to get the value of the password, you compare a user request's hash to the stored hash to determine auth. That said, you would want to get the actual email address's value, so no, you wouldn't hash it. You could encrypt it, but encryption can be broken and would be overkill in my opinion –  mituw16 Apr 2 at 18:03
I've done salts before, but is it necessary? Are emails, by definition, public? –  ilarsona Apr 2 at 18:04
Emails are not generally considered public, but neither are databases. What's your concern? That you can't secure a database? –  Marcus Adams Apr 2 at 18:05
If you really are that worried about security (which you should be), I suggest you research how to properly secure a database. Which really isn't that hard for mysql, change the root password, set proper user permissions, and enforce strong passwords. –  mituw16 Apr 2 at 18:06
As a developer, I feel the need to be responsible with user data... that's all. –  ilarsona Apr 2 at 18:06

Your Answer



Browse other questions tagged or ask your own question.