WeberDev.com PHP and MySQL Code

LOG IN
BEGINNER GUIDESPHP CLASSESCODE SEARCHARTICLES SEARCHPHP FORUMSPHP MANUALPHP FUNCTIONS LISTWEB SITE TEMPLATES
Start typing to search for PHP and MySQL Code Snippets and Articles Search


Submit a code Example / Snippet Join us on FaceBook
Submit a code Example / Snippet Submit Your Code
Search Engine Optimization Monitor SEO Monitor
Web Site UpTime Monitor UpTime Monitor
Your Personal Examples List My Favorite Examples
Your Personal Articles List My Favorite Articles
Edit Account Info Update Your Profile
PHP Code Search
Web Development Forums
Learn MySQL Playing Trivia
PHPBB2 Templates
Web Development Resources
Web Development Content
PHPClasses
PHP Editor
PHP Jobs
Vision.To Design
Ajax Tutorials
PHP Programming Help
PHP/MySQL Programming
Webmaster Resources
Webmaster Forum
XML meta language
website builder



Go Back Add a Comment Send this Article to a friend Add this Article to your personal favoritest for easy future access to your favorite Code Examples and Articles. Submit a code example Print this code example.
BACK ADD A COMMENT SEND TO A FRIEND ADD TO MY FAVORITES SUBMIT AN ARTICLE PRINT
Title : Creating a Secure PHP Login Script
Categories : PHP, Security
devarticles
devarticles
Date : 2004-03-27
Grade : 0 of 5 (graded 0 times)
Viewed : 20348
Search : More Articles by devarticles
Action : Grade This Article
Tools : My Favotite Articles


Submit your own code examples 
 


In this article Martin explains how to create a secure PHP login script that will allow safe authentication. Features remember-me function using cookies, validates logins on each request to prevent session stealing.

How Does This Work

This is a short explanation why I have chosen these authentication methods.

Users with shell access to the web server can scan valid session id's if the default /tmp directory is used to store the session data.

The protection against this kind of attack is the IP check.

Somebody who has a site (on a shared host with you) can generate valid session for your site.

This is why the checkSession method is used and the session id is recorded in the database.

Somebody may sniff network traffic and catch the cookie.

The IP check should eliminate this problem too.

Preparation

You need first to decide what information to store about members, the examples provided will assume almost nothing to make it easier to read.

I will use the PHP 4.1 super global arrays like $_SESSION, $_GET, etc. If you want to make it work on an earlier version of PHP you will have to substitute these with $GLOBALS['HTTP_SESSION_VARS'].

Read More...









PHP5: Designing And Using Interfaces
Categories : PHP, Object Oriented, Interfaces, PHP Classes, Security
User Authentication With patUser (part 2)
Categories : PHP, Authentication, Security
Working with Permissions in PHP, Part 1
Categories : PHP, Security
Protecting PHP Scripts with HTTP Authorization
Categories : PHP, HTTP, Security, Authentication
Exploring Session Security In PHP Web Applications
Categories : PHP, Security, Sessions, Web Applications
Writing A Port Scanner In PHP
Categories : PHP, HTTP, Security
Alternating row colors with PHP and mySQL
Categories : PHP, Databases, MySQL, HTML and PHP
tracking where and what on your site people are clicking
Categories : PHP, MySQL, HTML and PHP, HTML
Installing PHP Under Personal Web Server
Categories : Personal Web Server (PWS), PHP, Web Servers, Installation
Miles To Go Before I Sleep...
Categories : PHP, Calendar, Databases, MySQL
Building Cross Platform GUI Apps With PHP-GTK
Categories : PHP, PHP-GTK, GUI Apps
Writing Secure CGI scripts
Categories : CGI, Security
First issue of the SecuritySearch.Net Vulnerabilit
Categories : Security, Vulnerability Report
Multicolumn Output from a Database with PHP
Categories : PHP, Databases, HTML and PHP, MySQL
Jump Start to Easy URLs
Categories : PHP, Beginner Guides, MySQL, File System, To PHP