User Identification, saftest way?

pkh84

Hello,

I'm writing some scripts that uses MySQL. I'm using sessions to manage the logins/logouts. Now to some problems: Some users will only have read access, others read-write access and a few full access to everything (including drop and create table). It's very important that one user gets the correct rights. We were thinking of registering every username as a MySQL username. The only problem here is that a database connection is made in every script that runs, which means that the script should store the user's password somewhere (in a session variable perhaps) which is something I don't find very secure. I was thinking of encrypting the password before storing it in a session variable, but 1) from where can I get the libraries? I use the RPM version of PHP4 2) where should I store the encryption key?

Any suggestions? We're developing a commercial application and the security must be high!! Thanks for any help,

-Petter-

Anon

on my page http://dormroad.com - i have a user table. this contains user_id, username, password and type. type is used to identify one type of user from another. just check this value in your script and grant the appropriate access.

-paul
http://xhawk.net

reagent

creating multiple mysql users for every user of the system is NOT the way to go.

heres what i would do.
create 3 mysql users w/ appropriate permissions

i.e.
r_user
rw_user
full_user

Each of these usernames/password combos correspond to different permissions to the mysql datbase. (make these names more intuitive)

store the usernames/passwords in a file on the server that is OUTSIDE of the web root (i.e. the webserver user has access to it, but you cannot type in a url to get at them)

include file:
define("RO_USER_TYPE" 0);
define("RO_USER", "foo");
define("RO_USER_PASS", "bar");
... (repeat for other users)

then create a couple classes, one to handle the database connection, and one to store user information.

make your db connection class look something like this

require_once("your included usernames/pass file");

class Connection {
createConnection($iUserType = RO_USER_TYPE){
...
}

inside the connecton class, chekc the usertype you pass in and make your connection to the database based on that. you'll have to call createConnection() w/ no params first to find out what types of permissions that user has.

so in your user class, you want to have methods that will get back all info from the database. when you create a user, use md5() to encrypt the pass before inserting. then when you pull the info out, just compare the password in the database to the one they used to log in, just make sure to md5() their supplied password before comparing it to the one in the db.

you can also store the user object in the session, so you'll know what type of connection to make when the page is loaded..

hth.
p.

jc94062

This had me puzzled for a while, md5 is a 32bit hash, so when your storing it in the table, don't use something like varchar(8), cause it'll chop the end off and fail all passwords valid or not, varchar(32) works fine.

reagent

"don't use something like varchar(8), cause it'll chop the end off and fail all passwords valid or not, varchar(32) works fine."

good point, for all string values, no matter how long, md5() will return a 32 character string for the hash. Maybe char(32) is a better type b/c the data will always be 32 bytes.

Anon

Is this a safe way? What are the risks? Is it easy to hack a system like this?

-Petter-

reagent

Depending on how you implement it, it can be either secure or insecure. If you keep that include file w/ all the passwords in a web-accessible directory, it would be less secure, same as if you stored a username/password plaintext in a cookie.

My suggestion was just to get you thinking of an implementation. I like the idea of having separate mysql users for each role, as that will help secure it on a db level, but you need to be conscious of how you enforce security on the application level first and foremost. I would not use cookies and use sessions if this must be secure, and require everyone to log on between browser sessions..

good luck

pkh84

Thanks for your help. I'm already using sessions in my first prototype. BTW, which function is better, include_once() or require_once() it the included file is a "library" with classes/functions/variables?

-Petter-

reagent

require_once() seems the way to go, check the documentation though. require just does a simple replacement like the C preprocessor, while include will evaluate the code in the current context.

pkh84

Just one more thing. You suggested that I could store the user object in the session. Is this really possible? I read somewhere on PHP Builder that it's not possible to store objects in a session. Have you tried this and succeded?

-Petter-

Anon

Yes it is possible. I am doing now on two projects. Since learning how to do it, i wondered why I ever did it any other way 🙂

just make sure you declare your class before you use session_start()

i.e.
require_once("/petters/user.class");
session_start();

this goes for any other objects you store in the session.

pkh84

Hmm, I can register the object, but it looks like all variable values stored in it are erased....

I do it like this:
myobject = new MyClass;
MyClass->setMyValue("Test");

session_start();
session_register("myobject");

Have I forgotten anything?

You've been really helpful.

-Petter-

Anon

does it matter that you use
myobject = new MyClass;
and not
$myobject = new MyClass();

everything else looks ok. I am assuming that you have your class definition require'd at the top as well.

make sure you include your class definition as well as session_start() on any subsequent pages that need to access that object.

good luck, and you can email me directly with any other problems.
p.

pkh84

It's working now. Thanks for all your help.

-Petter-

Anon

When I try this as follows

test.php contains

1: dl("myclass.so");
2: $myClass = new myClass();
3:
4: session_start();
5: session_register("myClass");

test2.php contains

1: dl("myclass.so");
2:
3: session_register("myClass");
4: $myClass->myMethod();

I get the following error:

Fatal error: Object has an invalid handle property in test2.php on line 4

Does this look familiar?

How about storing the methods of the object anyway?
The manual states that methods are allways lost.
Is there any way around this?

Thanks in advance.
Vincent Jansen

Anon

1: dl("myclass.so");
2:
3: session_register("myClass");
4: $myClass->myMethod();
-------------------------------<

I assume the object myClass has been registered in test1.php.
Try using the following code in test2.php:
dl("myclass.so");

session_start();
$myClass->myMethod();

Does this help?

-Petter-