统一（C＃）和php密码处理

Question

I have a website where users can create an account, the password is hashed with SHA256 and all the info stored in a database.

I have a game made with unity3d , where the player have to login.

I used the WWW class to reach and get information from a login page of my website (of course no direct acces to the database). But I have to pass the username and password as POST values...

Now I have two question :

• I've read that I should use the php password library instead of SHA256, is that really critical?
• How can I login in the game without compromising security?

Answer 1

Check out this link here :

If you're a web developer, you've probably had to make a user account system. The most important aspect of a user account system is how user passwords are protected. User account databases are hacked frequently, so you absolutely must do something to protect your users' passwords if your website is ever breached. The best way to protect passwords is to employ salted password hashing. This page will explain why it's done the way it is.

It will give you the basics of how to securely send, store, and use a password in php and even provides tested source code for you to use. Please do not try and come up with your own homebrew solution, use what this resource and make sure you understand it if you want to make your login secure.