User Name Password Register
DaniWeb IT Discussion Community
All
What is DaniWeb IT Discussion Community?
You're currently browsing the PHP section within the Web Development category of DaniWeb, a massive community of 426,517 software developers, web developers, Internet marketers, and tech gurus who are all enthusiastic about making contacts, networking, and learning from each other. In fact, there are 2,063 IT professionals currently interacting right now! Registration is free, only takes a minute and lets you enjoy all of the interactive features of the site.
Please support our PHP advertiser: Lunarpages PHP Web Hosting
Views: 538 | Replies: 3
Reply
Join Date: Jul 2008
Location: Fort Worth, TX
Posts: 3
Reputation: bmarshall.0511 is an unknown quantity at this point 
Rep Power: 0
Solved Threads: 0
bmarshall.0511's Avatar
bmarshall.0511 bmarshall.0511 is offline Offline
Newbie Poster

Secure PHP Login Script

  #1  
Jul 24th, 2008
Alright so after many people asking me to post the login script I use for my site at locatestyle.com, I made two functions. Now these functions do not include everything that is used for the login procedure on locatestyle.com due to the fact I don't want everyone to know how the complete script works on there. Figure if you know completely how it works, the easier it is to find security flaws. Now granted this could be more secure by using cookies in conjunction with a column in the database for the cookie value to be stored but here's the basis. Let me know what you think and if you run into any errors.

function doLogin($username,$password) {
    if($_SERVER['SERVER_NAME'] == URL) {
        $find_user = mysql_query("SELECT * FROM ".USERS_TABLE." WHERE username = '$username' AND password = '$password' LIMIT 1");
        if(mysql_num_rows($find_user) == 1) {
            $user = mysql_fetch_array($find_user);
            if($user['active'] == 1) {
                $update_login = mysql_query("UPDATE ".USERS_TABLE." SET last_login = '".time()."',login_ip = '".$_SERVER['REMOTE_ADDR']."', WHERE id = '".$user['id']."'");
                $_SESSION['id'] = $user['id'];
                mysql_free_result($find_user);
            } else {
                $login_error = "Your account has not been activated yet.";
            }
        } else {
            $login_error = "Wrong username/password.";
        }
    } else {
        die("You do not have permission to login to this site.");
    }
}

function checkLogin() {
    if($_SESSION['id'] != '') {
        $user = mysql_fetch_array(mysql_query("SELECT * FROM ".USERS_TABLE." WHERE id = '".$_SESSION['id']."' LIMIT 1"));
        if($user['login_ip'] == $_SERVER['REMOTE_ADDR']) {
            $expired = $user['last_login'] + 600;
            if(time() >= $expired_time) {
                session_destroy();
                header('Location: index.php');
            } else {
                $update_login = mysql_query("UPDATE ".USERS_TABLE." SET last_login = '".time()."' WHERE id = '".$user['id']."'");
            }
        } else {
            session_destroy();
            header('Location: index.php');
        }
    }
} 

Now if your new to PHP and don't know what you need to change or how or even what columns you need in your table don't be afraid to ask.
Ben Marshall
locateSTYLE | Web Development Community
Free Website Templates, Stock Photography and more!
AddThis Social Bookmark Button
Reply With Quote  
Join Date: Jun 2008
Location: Phoenix, AZ
Posts: 771
Reputation: R0bb0b is on a distinguished road 
Rep Power: 2
Solved Threads: 63
R0bb0b's Avatar
R0bb0b R0bb0b is offline Offline
Master Poster

Re: Secure PHP Login Script

  #2  
Jul 24th, 2008
I hope you are validating that password.
$username = "blahblah";
$password = "blah' or '2' = '2"

if not, I could log in with just that.
Last edited by R0bb0b : Jul 24th, 2008 at 7:33 pm.
“Be who you are and say what you feel because those who mind don't matter and those who matter don't mind.” - Dr. Seuss
Reply With Quote  
Join Date: Jul 2008
Location: Fort Worth, TX
Posts: 3
Reputation: bmarshall.0511 is an unknown quantity at this point 
Rep Power: 0
Solved Threads: 0
bmarshall.0511's Avatar
bmarshall.0511 bmarshall.0511 is offline Offline
Newbie Poster

Re: Secure PHP Login Script

  #3  
Jul 24th, 2008
The password is validated by the function e.g. if password in the database is 'ghost' the only way a user will be able to login is with the password ghost
Ben Marshall
locateSTYLE | Web Development Community
Free Website Templates, Stock Photography and more!
Reply With Quote  
Join Date: Nov 2007
Location: Arkansas
Posts: 396
Reputation: buddylee17 will become famous soon enough buddylee17 will become famous soon enough 
Rep Power: 2
Solved Threads: 78
buddylee17's Avatar
buddylee17 buddylee17 is offline Offline
Posting Whiz

Re: Secure PHP Login Script

  #4  
Jul 24th, 2008
Alright so after many people asking me to post the login script I use for my site at locatestyle.com, I made two functions.
Who asked you to post this?
Lost time is never found again.
- Benjamin Franklin
Reply With Quote  
Reply

Only community members can participate in forum threads. You must register or log in to contribute.

DaniWeb PHP Marketplace
Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)

 

Thread Tools Display Modes

Similar Threads
Other Threads in the PHP Forum

All times are GMT -4. The time now is 6:14 pm.
Forum system based on vBulletin Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
©2003 - 2008 DaniWeb® LLC