WeberDev.com PHP and MySQL Code

LOG IN
BEGINNER GUIDESPHP CLASSESCODE SEARCHARTICLES SEARCHPHP FORUMSPHP MANUALPHP FUNCTIONS LISTWEB SITE TEMPLATES
Start typing to search for PHP and MySQL Code Snippets and Articles Search


Submit a code Example / Snippet Join us on FaceBook
Submit a code Example / Snippet Submit Your Code
Search Engine Optimization Monitor SEO Monitor
Web Site UpTime Monitor UpTime Monitor
Your Personal Examples List My Favorite Examples
Your Personal Articles List My Favorite Articles
Edit Account Info Update Your Profile
PHP Code Search
Web Development Forums
Learn MySQL Playing Trivia
PHPBB2 Templates
Web Development Resources
Web Development Content
PHPClasses
PHP Editor
PHP Jobs
Vision.To Design
Ajax Tutorials
PHP Programming Help
PHP/MySQL Programming
Webmaster Resources
Webmaster Forum
XML meta language
website builder



Go Back Add a Comment Send this Article to a friend Add this Article to your personal favoritest for easy future access to your favorite Code Examples and Articles. Submit a code example Print this code example.
BACK ADD A COMMENT SEND TO A FRIEND ADD TO MY FAVORITES SUBMIT AN ARTICLE PRINT
Title : Creating a Secure PHP Login Script
Categories : PHP, Security
devarticles
devarticles
Date : 2004-03-27
Grade : 0 of 5 (graded 0 times)
Viewed : 20302
Search : More Articles by devarticles
Action : Grade This Article
Tools : My Favotite Articles


Submit your own code examples 
 


In this article Martin explains how to create a secure PHP login script that will allow safe authentication. Features remember-me function using cookies, validates logins on each request to prevent session stealing.

How Does This Work

This is a short explanation why I have chosen these authentication methods.

Users with shell access to the web server can scan valid session id's if the default /tmp directory is used to store the session data.

The protection against this kind of attack is the IP check.

Somebody who has a site (on a shared host with you) can generate valid session for your site.

This is why the checkSession method is used and the session id is recorded in the database.

Somebody may sniff network traffic and catch the cookie.

The IP check should eliminate this problem too.

Preparation

You need first to decide what information to store about members, the examples provided will assume almost nothing to make it easier to read.

I will use the PHP 4.1 super global arrays like $_SESSION, $_GET, etc. If you want to make it work on an earlier version of PHP you will have to substitute these with $GLOBALS['HTTP_SESSION_VARS'].

Read More...









Protecting PHP Scripts with HTTP Authorization
Categories : PHP, HTTP, Security, Authentication
Exploring Session Security In PHP Web Applications
Categories : PHP, Security, Sessions, Web Applications
Writing A Port Scanner In PHP
Categories : PHP, HTTP, Security
PHP5: Designing And Using Interfaces
Categories : PHP, Object Oriented, Interfaces, PHP Classes, Security
User Authentication With patUser (part 2)
Categories : PHP, Authentication, Security
Working with Permissions in PHP, Part 1
Categories : PHP, Security
A Useful Event Calendar Written In PHP
Categories : PHP, Date/time, Calendar
Saving Images in MySQL
Categories : MySQL, PHP, Graphics, Databases
PHP References Explained
Categories : PHP References, PHP
How to Develop a Simple yet Secure Password System
Categories : Authentication, Security
Database Abstraction with PEAR
Categories : PHP, Pear, Databases
Aspect-Oriented Programming and PHP
Categories : PHP, Aspect Oriented Programming
Watching The Web
Categories : PHP, Databases, MySQL, HTTP, MD5
How To add paging (Pagination) with PHP and MySQL
Categories : PHP, Beginner Guides, Databases, MySQL, HTML and PHP
Multiple pages of data from a text file
Categories : PHP, Filesystem