[jdelator]

Originally Posted by Dismounted

If you are doing this sort of thing, make sure you include a secret that both scripts can verify (to prevent malicious use), maybe something like sha1($password . $secret) (of course don't use this one I just posted ).

Yeah I thought about this. I dont think its necessary. From a user point of view, they will never know the url to the php script (it's in the c# code). Also if they create an account this way, it wouldnt be any different from then using the website normally. The only difference is that a "sync" would not happen between the mssql and mysql server. I also have code that takes of the issue when a sync fails. I tried to come up with a case where someone malicious would try to create accounts where they somehow figured out the url and couldn't come up with a security issue.

The xml file doesnt contain the password, since on C# side it knows how to hash it.