Login

BlueCat · 05-23-2014, 09:07 PM

Does this Verify.php Look fine, Anything I need to add to it?

Code:
<?php 
if(isset($_POST['submit'])){ 
    $dbHost = "localhost";        //Location Of Database usually its localhost 
    $dbUser = "xxxx";            //Database User Name 
    $dbPass = "xxxxxx";            //Database Password 
    $dbDatabase = "db_name";    //Database Name 
     
    $db = mysql_connect($dbHost,$dbUser,$dbPass)or die("Error connecting to database."); 
    //Connect to the databasse 
    mysql_select_db($dbDatabase, $db)or die("Couldn't select the database."); 
    $usr = mysql_real_escape_string($_POST['username']); 
    $pas = hash('sha256', mysql_real_escape_string($_POST['password'])); 
    $sql = mysql_query("SELECT * FROM users_table  
        WHERE username='$usr' AND 
        password='$pas' 
        LIMIT 1"); 
    if(mysql_num_rows($sql) == 1){ 
        $row = mysql_fetch_array($sql); 
        session_start(); 
        $_SESSION['username'] = $row['username']; 
        $_SESSION['fname'] = $row['first_name']; 
        $_SESSION['lname'] = $row['last_name']; 
        $_SESSION['logged'] = TRUE; 
        header("Location: users_page.php"); // Modify to go to the page you would like 
        exit; 
    }else{ 
        header("Location: login_page.php"); 
        exit; 
    } 

?>

zomgwtfbbq · 05-23-2014, 10:01 PM

Haven't tried the code, but it looks ok. Just some things I'd like to mention:
1- mysql_xx functions are deprectated, use mysqli functions or pdo instead
2- after the login fails, before you redirect, call sleep(1) in order to prevent bruteforcing(even better is to also log failed attempts and block unwanted access)
3- it's more elegant to keep the frontend (login form) away from the script that handles the login verification(you can use an ajax call to see if the login was correct(just return some data such as a json encoded string)). This way the user can stay on the same page
4- I personally always salt passwords that I store in a database

Ex094 · 05-24-2014, 06:26 AM

- Use mysqli instead of mysql functions, it's totally depreciated and you're risking your script of being exploited.
- It's better to keep database configuration in another file

zomgwtfbbq has given some good advises, better listen to this PHP Ninja

Else the code looks fine

Singularity_mybb_import13102 · 09-10-2014, 02:35 PM

Yeah, I think the guys above covered most the things.
I recommend using mysqli functions instead as well.
Don't only add a salt to the hashed passwords in the database, but also ensure that each salt is unique from the others.
The generally accepted way of storing the database configuration information, is in a separate file and in an array.
You would just require the file, and call the array with the parameters you need.
I also like to use heredoc syntax for my SQL queries.
Here is an example of what that might look like:

db_info.php

Code:
$DB = array(
     'host' => 'localhost',
     'user' => 'root',
     'pass' => 'passw0rd',
     'db'   => 'db_name',
    );

connect.php

Code:
<?php
require_once('db_info.php');
$client = new mysqli($DB['host'], $DB['user'], $DB['pass'], $DB['db']);
$query = <<<SQL
    SELECT *
    FROM `table`
    WHERE `column_name` = $field
SQL;
if(!$result = $client->query($query)){
    die('Error: [' . $db->error . ']');
}
 
while($row = $result->fetch_assoc()){
    echo $row . '<br />';
}
 
$result->free();
$db->close();
?>

Singularity_mybb_import13102 · 09-10-2014, 02:35 PM

Yeah, I think the guys above covered most the things.
I recommend using mysqli functions instead as well.
Don't only add a salt to the hashed passwords in the database, but also ensure that each salt is unique from the others.
The generally accepted way of storing the database configuration information, is in a separate file and in an array.
You would just require the file, and call the array with the parameters you need.
I also like to use heredoc syntax for my SQL queries.
Here is an example of what that might look like:

db_info.php

Code:
$DB = array(
     'host' => 'localhost',
     'user' => 'root',
     'pass' => 'passw0rd',
     'db'   => 'db_name',
    );

connect.php

Code:
<?php
require_once('db_info.php');
$client = new mysqli($DB['host'], $DB['user'], $DB['pass'], $DB['db']);
$query = <<<SQL
    SELECT *
    FROM `table`
    WHERE `column_name` = $field
SQL;
if(!$result = $client->query($query)){
    die('Error: [' . $db->error . ']');
}
 
while($row = $result->fetch_assoc()){
    echo $row . '<br />';
}
 
$result->free();
$db->close();
?>

hackarchives · 09-12-2014, 07:45 PM

I prefer using captcha rather than using sleep and till now it has proven to be an effective measure to prevent bruteforcing

zomgwtfbbq · 09-19-2014, 06:11 PM

(09-12-2014, 07:45 PM)hackarchives Wrote: I prefer using captcha rather than using sleep and till now it has proven to be an effective measure to prevent bruteforcing

It's effective but not user friendly.

Psycho_Coder · 09-19-2014, 06:38 PM

More than mysqli I would recommend using PDO's and they are more secure.

hackarchives · 09-20-2014, 12:48 PM

(09-19-2014, 06:11 PM)zomgwtfbbq Wrote:
(09-12-2014, 07:45 PM)hackarchives Wrote: I prefer using captcha rather than using sleep and till now it has proven to be an effective measure to prevent bruteforcing
It's effective but not user friendly.

I use it in a way that form displays captcha if you have wrong password 5 consecutive times and then again after 5 times. So it makes it secure and friendly Smile

hackarchives · 09-20-2014, 12:48 PM

(09-19-2014, 06:11 PM)zomgwtfbbq Wrote:
(09-12-2014, 07:45 PM)hackarchives Wrote: I prefer using captcha rather than using sleep and till now it has proven to be an effective measure to prevent bruteforcing
It's effective but not user friendly.

I use it in a way that form displays captcha if you have wrong password 5 consecutive times and then again after 5 times. So it makes it secure and friendly Smile

Login
Author Message