WeberDev.com PHP and MySQL Code

LOG IN
BEGINNER GUIDESPHP CLASSESCODE SEARCHARTICLES SEARCHPHP FORUMSPHP MANUALPHP FUNCTIONS LISTWEB SITE TEMPLATES
Start typing to search for PHP and MySQL Code Snippets and Articles Search


Submit a code Example / Snippet Join us on FaceBook
Submit a code Example / Snippet Submit Your Code
Search Engine Optimization Monitor SEO Monitor
Web Site UpTime Monitor UpTime Monitor
Your Personal Examples List My Favorite Examples
Your Personal Articles List My Favorite Articles
Edit Account Info Update Your Profile
PHP Code Search
Web Development Forums
Learn MySQL Playing Trivia
PHPBB2 Templates
Web Development Resources
Web Development Content
PHPClasses
PHP Editor
PHP Jobs
Vision.To Design
Ajax Tutorials
PHP Programming Help
PHP/MySQL Programming
Webmaster Resources
Webmaster Forum
XML meta language
website builder



Go Back Add a Comment Send this Article to a friend Add this Article to your personal favoritest for easy future access to your favorite Code Examples and Articles. Submit a code example Print this code example.
BACK ADD A COMMENT SEND TO A FRIEND ADD TO MY FAVORITES SUBMIT AN ARTICLE PRINT
Title : Creating a Secure PHP Login Script
Categories : PHP, Security
devarticles
devarticles
Date : 2004-03-27
Grade : 0 of 5 (graded 0 times)
Viewed : 20584
Search : More Articles by devarticles
Action : Grade This Article
Tools : My Favotite Articles


Submit your own code examples 
 


In this article Martin explains how to create a secure PHP login script that will allow safe authentication. Features remember-me function using cookies, validates logins on each request to prevent session stealing.

How Does This Work

This is a short explanation why I have chosen these authentication methods.

Users with shell access to the web server can scan valid session id's if the default /tmp directory is used to store the session data.

The protection against this kind of attack is the IP check.

Somebody who has a site (on a shared host with you) can generate valid session for your site.

This is why the checkSession method is used and the session id is recorded in the database.

Somebody may sniff network traffic and catch the cookie.

The IP check should eliminate this problem too.

Preparation

You need first to decide what information to store about members, the examples provided will assume almost nothing to make it easier to read.

I will use the PHP 4.1 super global arrays like $_SESSION, $_GET, etc. If you want to make it work on an earlier version of PHP you will have to substitute these with $GLOBALS['HTTP_SESSION_VARS'].

Read More...









Protecting PHP Scripts with HTTP Authorization
Categories : PHP, HTTP, Security, Authentication
Exploring Session Security In PHP Web Applications
Categories : PHP, Security, Sessions, Web Applications
Writing A Port Scanner In PHP
Categories : PHP, HTTP, Security
PHP5: Designing And Using Interfaces
Categories : PHP, Object Oriented, Interfaces, PHP Classes, Security
User Authentication With patUser (part 2)
Categories : PHP, Authentication, Security
Working with Permissions in PHP, Part 1
Categories : PHP, Security
Building XML Trees with PEAR's XML_Tree Class
Categories : PHP, Pear, XML
Setup and Install Apache with PHP4 as a Dynamic Module (DSO)
Categories : PHP, PHP Configuration, Apache
PHP 101 Part 11 of 15 : Sinfully Simple
Categories : PHP, SimpleXML, XML
Beginners Guide to PHP - Introduction to cookies
Categories : Beginner Guides, Cookies, To PHP, PHP
The Biggest Vulnerability of All, by Anna Johnson
Categories : Human Factors, Security
Honey, I Shrunk My Website
Categories : PHP, PHP options/info, Site Planning, Other
PHP 101 Part 8 of 15 : Databases and Other Animals
Categories : PHP, Beginner Guides, Databases
Simple PHP Templates With PatTemplate
Categories : PHP, Templates
Referer Statistics
Categories : PHP, MySQL, HTTP, Databases