0

Well, I created login which works pretty fine, but I'm worried about its security. For checking if user is logged in I use only this

$auth = $_COOKIE['authorization'];
header ("Cache-Control:no-cache");
if($auth !== "ok") {
    header ("Location:index.php");
    exit();
}

which is really bad I know, but I want to know what can I do to secure it even more, this is login form:

    <?php 

    error_reporting(0);

    session_start();


    include("database.php");
    if(isset($_POST['login_button']))
    {

        $userName = mysqli_real_escape_string($con, $_POST['username']); 
        $userPass = mysqli_real_escape_string($con, $_POST['password']); 

        $hashedPass = hash('whirlpool', $userPass);

        $query = mysqli_query($con, "SELECT Ime, Lozinka, Confirmed FROM `Igraci` WHERE  `Ime` = '$userName' AND `Lozinka` = '$hashedPass' AND `Confirmed` = '1'") or die(mysqli_error());
        $row = mysqli_num_rows($query);

        if($row > 0)
        {
            setcookie("username", $_POST['username'], time()+3600*24);
            setcookie("authorization","ok");
            header( "Location:welcome.php");
            exit();
        }
        else
        {
            echo '


            </br><div class="flash_error">Podatci koje ste uneli nisu ispravni, ili vas racun nije aktiviran.</div>

            ';


        }
    }

    if(isset($_GET['logout']))
    {
        setcookie("username", "", time()-60);
        setcookie("authorization","");
        header( "Location:index.php");
        exit(); # stop executing here
    }

    if($_COOKIE['authorization'] == "ok") 
    {
        header ("Location:welcome.php");
        exit();
    }

?>
  • This is wholly insecure. You should not implement your own security, and especially when PHP has a strong authentication system for you to use. – Neil Smithline Feb 14 '16 at 17:47
  • Additionally, it may be vulnerable to SQL injection, even with the escape function. Look into using prepared statements. – multithr3at3d Feb 14 '16 at 21:04
  • Don't write your own auth system unless you're an expert. Use a framework – Neil McGuigan Feb 14 '16 at 22:53
3

The problem with this login is that setting a username cookie with a value and setting an authorization cookie with a value of ok will log someone in. I would highly recommend reading up on PHP, sessions, and authentication.

  • I understand sessions a little bit, but i want to know, what if i make session on index.php for example $_SESSION["user_id"] = $row[user_id]; $_SESSION["user_name"] = $row[user_name]; is there a way to check if these sessions match somehow on for example dashboard.php and if not do log him out and destroy them thats only thing that is kinda worrying me at the moment. – Nathaniel Feb 14 '16 at 16:39
  • The issue is that you aren't properly establishing a session to check against. You start the session but don't do anything with it. As it is now, your login can be bypassed, and that's what you should be worried about. – h4ckNinja Feb 14 '16 at 17:46
  • It's like this now, is this ok ? pastebin.com/sv71wK8s – Nathaniel Feb 14 '16 at 18:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.