14

I need to implement basic personalized user functionality for my website. Is there a standard structure for databases of this type? Like is it common practice to have all user info and data in a single table with each user having his own row, or should this info be split among different tables and linked together (maybe for efficiency?) I'm not tremendously concerned with security at this point, but I'll obviously want to have password encryption before too long.

I tried to find what I was looking for on google, but to no avail. Just let me know if the question needs further clarification or anything.

17

I suggest that you use typical normalization standards. One user per row.

  • User ID (incrementing bigint)
  • User Common Name (to be displayed on the site)
  • User Email Address
  • Password Salt (Unique for every user, inserted when the account is created)
  • Password (Hashed with the salt - MD5 or SHA1, your preference)
  • Date Account Was Created

The rest is up to you given your business rules.

  • Modern password hashing choices would be argon2, bcrypt, or scrypt. – douggard yesterday
8

Going to have to go for a big old fashion "it depends".

Of course you are going to need some sort of key on this table. You could start off with a UserID. This could just be a incrementing INT (or bigint if you are going to have over 2.1 million users).

I've seen lots of databases also use GUIDs as the main UserID. But that's opening a whole different can of worms using GUIDs for PKs.

You then need to decide how normalized you want your database. Are you going to allow your user to have multiple emails? multiple phone numbers? If so, they should be in a different table.

I'd keep the main user table to:

  • some sort of ID or PK you can use
  • First Name/Last Name or just a username
  • some sort of status of the user (active, disabled, etc) - (tinyint linking to a status table)
  • created date

That should be your starting point.

From there you could add other columns based on what you want to store. Email could link to an email table, address to an address table, etc. Password could use hash+salt but have you considered openids?

I HIGHLY recommend you read this article though - http://www.sqlservercentral.com/articles/data-modeling/71725/

0

If it is about authentication of users, I would use LDAP. Do not create a separate database for the users, if you already use a database and have other tables (orders, products, etc). You may want to join these tables.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.