WeberDev.com PHP and MySQL Code

LOG IN
BEGINNER GUIDESPHP CLASSESCODE SEARCHARTICLES SEARCHPHP FORUMSPHP MANUALPHP FUNCTIONS LISTWEB SITE TEMPLATES
Start typing to search for PHP and MySQL Code Snippets and Articles Search


Submit a code Example / Snippet Join us on FaceBook
Submit a code Example / Snippet Submit Your Code
Search Engine Optimization Monitor SEO Monitor
Web Site UpTime Monitor UpTime Monitor
Your Personal Examples List My Favorite Examples
Your Personal Articles List My Favorite Articles
Edit Account Info Update Your Profile
PHP Code Search
Web Development Forums
Learn MySQL Playing Trivia
PHPBB2 Templates
Web Development Resources
Web Development Content
PHPClasses
PHP Editor
PHP Jobs
Vision.To Design
Ajax Tutorials
PHP Programming Help
PHP/MySQL Programming
Webmaster Resources
Webmaster Forum
XML meta language
website builder



Go Back Add a Comment Send this Article to a friend Add this Article to your personal favoritest for easy future access to your favorite Code Examples and Articles. Submit a code example Print this code example.
BACK ADD A COMMENT SEND TO A FRIEND ADD TO MY FAVORITES SUBMIT AN ARTICLE PRINT
Title : Creating a Secure PHP Login Script
Categories : PHP, Security
devarticles
devarticles
Date : 2004-03-27
Grade : 0 of 5 (graded 0 times)
Viewed : 20170
Search : More Articles by devarticles
Action : Grade This Article
Tools : My Favotite Articles


Submit your own code examples 
 


In this article Martin explains how to create a secure PHP login script that will allow safe authentication. Features remember-me function using cookies, validates logins on each request to prevent session stealing.

How Does This Work

This is a short explanation why I have chosen these authentication methods.

Users with shell access to the web server can scan valid session id's if the default /tmp directory is used to store the session data.

The protection against this kind of attack is the IP check.

Somebody who has a site (on a shared host with you) can generate valid session for your site.

This is why the checkSession method is used and the session id is recorded in the database.

Somebody may sniff network traffic and catch the cookie.

The IP check should eliminate this problem too.

Preparation

You need first to decide what information to store about members, the examples provided will assume almost nothing to make it easier to read.

I will use the PHP 4.1 super global arrays like $_SESSION, $_GET, etc. If you want to make it work on an earlier version of PHP you will have to substitute these with $GLOBALS['HTTP_SESSION_VARS'].

Read More...









Exploring Session Security In PHP Web Applications
Categories : PHP, Security, Sessions, Web Applications
Writing A Port Scanner In PHP
Categories : PHP, HTTP, Security
PHP5: Designing And Using Interfaces
Categories : PHP, Object Oriented, Interfaces, PHP Classes, Security
User Authentication With patUser (part 2)
Categories : PHP, Authentication, Security
Working with Permissions in PHP, Part 1
Categories : PHP, Security
Protecting PHP Scripts with HTTP Authorization
Categories : PHP, HTTP, Security, Authentication
PHP And Regular Expressions 101
Categories : PHP, Regexps
String Theory - A discussion of PHP string function
Categories : PHP, Strings
Simple Connection to PostgreSQL with PHP
Categories : PHP, PostgreSQL, Databases
Making PHP Forms Object-Oriented
Categories : PHP, HTML and PHP, Object Oriented
Extracting Elements from a Database into a Select Form Field
Categories : PHP, HTML
Introduction to using PHP 5.0 and SQLite
Categories : PHP, SQLite, Databases
File And Directory Manipulation In PHP (part 2)
Categories : PHP, Filesystem, Directories
An Alternative to Perl: Shell Scripting With PHP
Categories : PHP, Shell Scripting
Ecommerce security - The developer's side
Categories : Ecommerce, Security, Site Planning