WeberDev.com PHP and MySQL Code

LOG IN
BEGINNER GUIDESPHP CLASSESCODE SEARCHARTICLES SEARCHPHP FORUMSPHP MANUALPHP FUNCTIONS LISTWEB SITE TEMPLATES
Start typing to search for PHP and MySQL Code Snippets and Articles Search


Submit a code Example / Snippet Join us on FaceBook
Submit a code Example / Snippet Submit Your Code
Search Engine Optimization Monitor SEO Monitor
Web Site UpTime Monitor UpTime Monitor
Your Personal Examples List My Favorite Examples
Your Personal Articles List My Favorite Articles
Edit Account Info Update Your Profile
PHP Code Search
Web Development Forums
Learn MySQL Playing Trivia
PHPBB2 Templates
Web Development Resources
Web Development Content
PHPClasses
PHP Editor
PHP Jobs
Vision.To Design
Ajax Tutorials
PHP Programming Help
PHP/MySQL Programming
Webmaster Resources
Webmaster Forum
XML meta language
website builder



Go Back Add a Comment Send this Article to a friend Add this Article to your personal favoritest for easy future access to your favorite Code Examples and Articles. Submit a code example Print this code example.
BACK ADD A COMMENT SEND TO A FRIEND ADD TO MY FAVORITES SUBMIT AN ARTICLE PRINT
Title : Creating a Secure PHP Login Script
Categories : PHP, Security
devarticles
devarticles
Date : 2004-03-27
Grade : 0 of 5 (graded 0 times)
Viewed : 20068
Search : More Articles by devarticles
Action : Grade This Article
Tools : My Favotite Articles


Submit your own code examples 
 


In this article Martin explains how to create a secure PHP login script that will allow safe authentication. Features remember-me function using cookies, validates logins on each request to prevent session stealing.

How Does This Work

This is a short explanation why I have chosen these authentication methods.

Users with shell access to the web server can scan valid session id's if the default /tmp directory is used to store the session data.

The protection against this kind of attack is the IP check.

Somebody who has a site (on a shared host with you) can generate valid session for your site.

This is why the checkSession method is used and the session id is recorded in the database.

Somebody may sniff network traffic and catch the cookie.

The IP check should eliminate this problem too.

Preparation

You need first to decide what information to store about members, the examples provided will assume almost nothing to make it easier to read.

I will use the PHP 4.1 super global arrays like $_SESSION, $_GET, etc. If you want to make it work on an earlier version of PHP you will have to substitute these with $GLOBALS['HTTP_SESSION_VARS'].

Read More...









Exploring Session Security In PHP Web Applications
Categories : PHP, Security, Sessions, Web Applications
Writing A Port Scanner In PHP
Categories : PHP, HTTP, Security
PHP5: Designing And Using Interfaces
Categories : PHP, Object Oriented, Interfaces, PHP Classes, Security
User Authentication With patUser (part 2)
Categories : PHP, Authentication, Security
Working with Permissions in PHP, Part 1
Categories : PHP, Security
Protecting PHP Scripts with HTTP Authorization
Categories : PHP, HTTP, Security, Authentication
Webstatistics with Redirectors
Categories : PHP, HTML, HTML and PHP
Getting Intimate With PHP's Mail() Function
Categories : PHP, Mail, PHP Functions
Building a PHP Style Switcher
Categories : PHP, Sessions, Personalization and Membership
Understanding Modern Denial of Service
Categories : Security
PHP 101 Part 9 of 15 : SQLite My Fire!
Categories : PHP, Beginner Guides, Databases, SQLite
Building An FTP Client With PHP
Categories : PHP, FTP
Beginners guide to PHP and MySQL
Categories : PHP, Beginner Guides, Databases, MySQL, Installation
Logging with PHP
Categories : PHP, Log Files
Descriptions of Common Data Types
Categories : MySQL, Databases, PHP, PHP options/info, General