hur pass säkert/osäkert är detta php login
Efter att ha suttit och kollat/läst igenom massa tutorials hit och dit har jag lyckats få ihop ett system som fungerar... Dock är frågan hur pass säkert är detta?
Vad kan förbättras förutom allt?
index.php
<?php
session_start();
require 'database.php';
if( isset($_SESSION['user_id']) ){
$records = $conn->prepare('SELECT UserID,UserName,Email,Password FROM Users WHERE id = :id');
$records->bindParam(':id', $_SESSION['user_id']);
$records->execute();
$results = $records->fetch(PDO::FETCH_ASSOC);
$user = NULL;
if( count($results) > 0){
$user = $results;
}
}
?>
<!DOCTYPE html>
<html>
<head>
<title></title>
<link rel="stylesheet" type="text/css" href="assets/css/style.css">
</head>
<body>
<?php if( !empty($user) ): ?>
<br />Welcome <?= $user['email']; ?>
<br /><br />You are successfully logged in!
<br /><br />
<a href="logout.php">Logout?</a>
<?php else: ?>
<h1>Please Login or Register</h1>
<a href="login.php">Login</a> or
<a href="register.php">Register</a>
<?php endif; ?>
</body>
</html>
login.php
<?php
session_start();
if( isset($_SESSION['user_id']) ){
header("Location: admin.php");
}
require 'database.php';
if(!empty($_POST['username']) && !empty($_POST['password'])):
$records = $conn->prepare('SELECT UserID,UserName,Email,Password FROM Users WHERE UserName = :username');
$records->bindParam(':username', $_POST['username']);
$records->execute();
$results = $records->fetch(PDO::FETCH_ASSOC);
$message = '';
if(count($results) > 0 && password_verify($_POST['password'], $results['Password']) ){
$_SESSION['user_id'] = $results['UserID'];
header("Location: admin.php");
} else {
$message = 'Sorry, those credentials do not match';
}
endif;
?>
<!DOCTYPE html>
<html>
<head>
<title></title>
<link rel="stylesheet" type="text/css" href="assets/css/style.css">
</head>
<body>
<?php if(!empty($message)): ?>
<p><?= $message ?></p>
<?php endif; ?>
<form action="login.php" method="POST">
<input type="text" placeholder="username" name="username">
<input type="password" placeholder="password" name="password">
<input type="submit">
</form>
</body>
</html>
register.php
<?php
session_start();
if( isset($_SESSION['user_id']) ){
require 'database.php';
$message = '';
if(!empty($_POST['email']) && !empty($_POST['password'])):
$sql = "INSERT INTO Users (UserName, Email, Password) VALUES (:username, :email, :password)";
$stmt = $conn->prepare($sql);
$stmt->bindParam(':username',$_POST['username']);
$stmt->bindParam(':email', $_POST['email']);
$stmt->bindParam(':password', password_hash($_POST['password'], PASSWORD_BCRYPT));
if( $stmt->execute() ):
$message = 'Successfully created new user';
else:
$message = 'Sorry there must have been an issue creating your account';
endif;
endif;
?>
<!DOCTYPE html>
<html>
<head>
<title></title>
<link rel="stylesheet" type="text/css" href="assets/css/style.css">
</head>
<body>
<?php if(!empty($message)): ?>
<p><?= $message ?></p>
<?php endif; ?>
<form action="register.php" method="POST">
<input type="text" placeholder="username" name="username">
<input type="text" placeholder="Enter your email" name="email">
<input type="password" placeholder="and password" name="password">
<input type="password" placeholder="confirm password" name="confirm_password">
<input type="submit">
</form>
</body>
</html>
<?php }
else {
session_start();
if (!isset($_SESSION['user_id'])){
echo "No can do sir!";
}
}
?>
logout.php
<?php
session_start();
session_unset();
session_destroy();
header("Location: login.php");
database.php
<?php
$server = '*******';
$username = '******';
$password = '******';
$database = '********';
try{
$conn = new PDO("mysql:host=$server;dbname=$database;", $username, $password);
} catch(PDOException $e){
die( "Connection failed: " . $e->getMessage());
}
admin.php
<?php
session_start();
if( isset($_SESSION['user_id']) ){
?>
<p>lots of secrets!!</p>
<a href="logout.php">LOGOUT</a>
<?php
}
else {
echo "no way you're allowed here";
}
?>
Citera om du vill ha svar :)
