Advice please (login script) :)

[MobiTec]

Hi, thanx for clicking this post 🙂

I am just wanting some advice please...

Would some of you PHP novice's, guru's kindly give me some help
on finding a secure loging script, that is either available to download
and modify, or some sort of tutorial that is easily understandable

i know some basic's of PHP and wanting to improve but i am after
a login script quite urgently to at least get my site secure and underway

all help is/will be very much appreciated

Ps, thank for taking the time to read this post....

Regards,

MobiTec

[lilleman]

Hi

When I create a login script for a user-system, I always use sessions. The reason to why I use sessions instead of cookies are that it's easier to use (you can assign values to session-variables in the same way as you do with regular variables) and you can also do more checks to see that a user really own the session he's using (yes, it is possible to steal a session).

To make sessions secure, I always have a field in my users table where I store the IP-address for each session-id. Then I've got a script in a PHP-file that make sure that the session belong to the active user. That script is included on each page.

Now, this wasn't so much information on how to build one, I just wanted to give you some tips of how to make your login-script secure.

/ Erik

[chads2k2]

Yeah this wouldn't really build one for you. Though I will give you some of my advice that I always have used since I started this back in the day. I always ALWAYS use a database to store my users information. Why? Because stealing a database is not an easy feat (though possible) ... so the more MD5's and such you add in to their passwords and timeouts for incorrect passwords to lock the account the better. That will help with the "Iron fists" that go through and try to brute their way into your site. Dirty but it happens none the less. So we will recap:

-USE SESSIONS!
-Check their IP with their session IP.
-Use a database to store usernames/passwords
-Use MD5 Checksums to encode their Username/password
-Also use encrypt() and decrypt() to transfer information
-Have a total of bad password attempts ... over 8 lock account.

I can't think off the top of my head anything else I use on a regular basis when making secure scripts for logins. This is really REALLY bad but I only do all the above for my admins. lol. I use Sessions, Checking IP's, and Database for Username/Password for my other users. lol. Really bad right? All well nobody has complained yet.

From here it should get your little mind racing. Have fun and ask questions ... that is what we are here for. Good first post lilleman!

Chad

[MobiTec]

Thank's chads2k2 and lilleman

Much appreciated... "Writes it down 🙂 for future refference"
excelent tips, thanx

But now i just need info on where to start, ie.. some tutorial or pre done script to learn / work from
("finds it very hard working from nothing... lol")

anyone have any idea's on that please???

[leatherback]

Hi,

Hm..

How about the forum itself?

But.. Have a look at this stripped down version (Sorry, not keen on showing my data treatment). which will get you started, I am sure:

if (!$_SESSION['SomeVar'])  

   {
   if(isset($_POST[one]))
     {
    $username = $_POST['username'];
        $username = $username;
    $password = $_POST['password'];
        $password = $password; 

                                //****** Form has been submitted, check details ******

 $result =@ mysql_query("Select * from users");
// echo $query;
 $NumRows =@ mysql_numRows($result);

 if ($NumRows > 0)                        // ****** Details are correct ******
    {
    while($row =@ mysql_fetch_array($result))
       {
         session_register(displayname);
        }
     $body = "Welkom $displayname, uw login was succesvol. <br><a href=\"index.php\">Ga verder met onderhoud aan de database</a>";   
    }
 else
    {
       $body = "<h2>Foute login</h2>
       Helaas, deze combinatie is niet correct.
       <br>
       <form action = \"index.php\" method=\"post\">
       <table>
       <tr>
       <td>Gebruikersnaam: </td><td><input type=\"textbox\" name=\"username\"></td></tr>
       <tr>
       <td>Wachtwoord: </td><td><input type=\"password\" name=\"password\"></td></tr>
       <tr>
       <td></td><td><input type=\"hidden\" name=\"one\" value=\"1\">
       <input type =\"submit\" class=\"button1\" value=\"Log In\"></td></tr></table>
       </form>
       <br><hr><br>
       <center><i>this is a classified section of the website, 
       and can only be accessed using a proper password / username combination. <br>
       If you are entitled to have acces to this section, you can get a username & password from the website administrator.";
    }  // end of wrong login
  }  // end of form has been submitted
  else
    {
          session_destroy();

      $body = "<h2>PROJECTEN LOGIN</h2>
      Log in met gebruikersnaam & wachtwoord.
      <form action = \"index.php\" method=\"post\">
       <table>
       <tr>
       <td>Gebruikersnaam: </td><td><input type=\"textbox\" name=\"username\"></td></tr>
       <tr>
       <td>Wachtwoord: </td><td><input type=\"password\" name=\"password\"></td></tr>
       <tr>
       <td></td><td><input type=\"hidden\" name=\"one\" value=\"1\">
       <input type =\"submit\" class=\"button1\" value=\"Log In\"></td></tr></table>
       </form>
       <br><hr><br>
       <center><i>this is a classified section of the website, 
       and can only be accessed using a proper password / username combination. <br>
       If you are entitled to have acces to this section, you can get a username & password from the website administrator.";
}
 } //  end of logn routine
else
 {

include("../includes/checkvar.php");

[chads2k2]

Hey I will throw in my login script as well. Might give a better idea of just what we are talking about. This one is VERY low in the security world. NO MD5's, no encryption. Hell NOTHING. BUT it does show you how to do one login script. Simple and to the point. If you have questions let me know. Thanks!!

<?php

//MUST HAVE IF USING SESSIONS!  Session_start() tells PHP to continue a session.
// If a session isn't started it will start one.
session_start();

//These next two you will look up with your database.
// I just hardcoded in so it will make it easier to see how it
// goes in the script.
$desired_email = "someemail";
$desired_password = "securedpassword_lol";

//Check to see if the username equals the username in the system.
if($desired_email == $given_email)
{
	//IF yes then it will now check the password given to the password in the system.
	if($desired_password == $given_password)
	{
		//Holy crap we have a match!  SWEET!  Now declare all your session variables.
		$_SESSION['GLOBAL_login'] = "Logged In";

	//This next part just displays a pop-up box saying they have been logged in.
	// Also the code parent.top.location.href='template.php'; is what will load
	// after the message has been "ok"ed.  That way you don't mess with headers that
	// have already been sent.  Makes life a little easier. 
	?>
	<SCRIPT LANGUAGE="JAVASCRIPT" TYPE="TEXT/JAVASCRIPT">
    <!-- Hide script from old browsers

       alert("You have been logged in.  Going to the template.")

    // End hiding script from old browsers -->
    parent.top.location.href='template.php';
</SCRIPT>
<?php
   }
   //If anyone of those two fail (password or username) then
   //The messages are displayed.  As well as the form so they can
   // try again.
   echo "I am sorry either the password or username is incorrect.";
   echo "<br> Try again.";
}
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>Dude PHP ROCKS!</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>

<body bgcolor="#f6f8fA">
<form name="form1" method="post" action="index.php">
      <strong>E-Mail:</strong>
      <input name="given_email" type="text" class="text_boxes_supplier">
      <br>
      <strong>Password:</strong>
      <input name="given_password" type="password" class="text_boxes_supplier">
      <br>
      <input type="submit" class="text_boxes_supplier" value="Login Now!">
</form>
</body>
</html>

[EDIT NOTE] I took out the smilies. It formated them into gifs, which isn't what I needed it to do. [/EDIT]
Chad