Best method of identifying users from the db?

[Sykoi]

I need to find a method to confirm a user is who they say they are from another site, by checking the vB_user table, from a site outside of vBulletin's architecture... Now I was going to have them enter their user id, and a hidden profile key they pick themselves, but I'm not sure if this is such a great idea... What would be a good idea?

Could I just confirm it with id, md5(md5(password,$salt)) or whatever password protection method vBulletin uses?

[Attilitus]

Well additional information would be useful. Such as the degree of access that you have to the external database.

[Adrian Schneider]

Check their username/password against the vB. database.

select userid
from user
where username = 'usetname sent' and password = md5(concat(md5('password sent'), salt));

[Sykoi]

So...

PHP Code:

SELECT * from vb3_user WHERE userid=### AND password=md5(concat(md5(password),vb3_user.salt)) 


Is this correct? Or are you referring to php functions of md5/concat and not mysql (Is concat even in mysql...?)

And as for the extent at which I have access, I have complete access to the database but no access to the vB php files.

Also, while I have asked this before I'll ask again - is there any way to create a forum "blindly", as in outside the architecture? I looked at the forums table and its incredibly complex and requires some vB-only generated things.

[Adrian Schneider]

Do it in MySQL, it is simpler that way (my query should work). Get them to enter their username - not their userid. You can change my select userid to select *

[Sykoi]

Well my problem with entering a user's name is that ... Is, well - easy to screw up... A lot of my forum members have unicode in their name, spaces in their name, etc.... Things that are easy to mess up

[Adrian Schneider]

Well how do they sign-on in the first place?

Userid is easy too, simple enough to change that in the above query...

[Sykoi]

Good point... Guess userid is kind of hard for some people to get, although my concern was the people (Like myself) who click "Remember me"... I haven't logged in for almost a year :P

Anyways, on a related note - whats the best way to create a new forum blindly?:

Also, while I have asked this before I'll ask again - is there any way to create a forum "blindly", as in outside the architecture? I looked at the forums table and its incredibly complex and requires some vB-only generated things.

[Adrian Schneider]

I don't have the time to go into much detail, but you could take the array that vBulletin generates and share that with your other site (save as .php file using var_export or serialized array). That would make it easier to process.

[Sykoi]

So basically get the function in the admin area to generate a new forum, use it to generate a dummy forum with the permissions I need, access the data inside that (Securely with a keycode or something) using readfile or fopen, unserialize the array, and simply replace the variables I need and commit that to the database...?