将相同的数据库用于客户端哈希，盐和设置是否会暴露客户端哈希？

Question

If I have an XML database on my web server;

<Database>
    <Client sid="0123456789abcdefg" name="John Doe" email="johndoe@mail.com" hash="9876543210abcdefg" salt="abcdefg9876543210">
        <Setting>A Setting</Setting>
        <Setting>Another Setting</Setting>
    </Client>
    ...
</Database>

And I log in with the hash and salt, retrieve the SID, and redirect to the home page via PHP;

header("Location: home.html?sid=" . $sid);

And then use the SID in the location bar via JavaScript to retrieve the user settings from , will I expose my clients' hash?

Is there a better way, or a more standard way, to set and get user settings on the web?

PS: Unless you have a really good reason, I really, really, really, don't want to use SQL. I prefer to be able to read my databases, and I like the tangibility and versatility of XML.

After a little more research, I learned that PHP supports a system for storing SESSION[] variables. This is perfect for me because I am, in fact, using sessions!

The W3C says:

"A PHP session variable is used to store information about, or change settings for a user session. Session variables hold information about one single user, and are available to all pages in one application."

Much better than exposing various data in the address bar. =)

Answer 1

As long as your DB file is inaccessable from HTTP (ie locked by a .htaccess or equivalent) and other protocols (ie not sitting in a directory accesable by anonymous FTP), the only risk is to (inadvertently) let the hash&salt be collected among a bunch of other user-related data and sent to your clients.

If you have requests equivalent to the SQL * selector, that might be somewhat of a problem. You might want to put the critical data into a different DB file and encapsulate the accesses in an interface dedicated to user registration and login, just to make sure no other piece of code will be able to grab them (even by mistake) from your main DB.