Authentication and special member features.

[unreal128]

I built my own authentication/login system. Once the user's name and password are validated against the database, a cookie is set with the username and salted md5 hash username string in there as well. My cookie validation will take the salted md5 hash of the username and compare it against the same salted md5 hash derived from the server. If the two match, I set the variables username and auth_token; auth_token will be given a value of 1. My problem is that some of the website features require members to be logged in and the special features pull data from the database according to the user's ID (or UID which is an integer.) I could create a function that grabs the set username and search the database for the UID, but this seems awkward and error prone. Is there a way to store the UID in either the cookie or session, that will allow me to access the UID without referencing the database and also shield it from basic attacks?

[unreal128]

As a workaround, I ended up setting the UID when I successfully validate a cookie. This still sort of erks me and I am thinking about making the whole user authentication system object oriented such that the UID is directly pulled from the database rather than a database query from the username in the cookie. Luckily I strip beginning/ending whitespace before inserting usernames in the database so its not that unsafe. :glare:

// the encryptString function salts and hash whatever string is passed
// the getUserID function is a mySQL query that grabs the UID based on username

function validateCookie()
{
	unset($username, $uid, $password, $auth_token);

if ($_COOKIE['login']) {
	list($cookie_username, $cookie_hash) = split(',',$_COOKIE['login']);
	$username_encrypted = encryptString($cookie_username);
	$cookie_hash_clean = rtrim($cookie_hash);
	if ($username_encrypted == $cookie_hash_clean) {
		global $username, $uid, $auth_token;			
		$username = $cookie_username;
		$auth_token = 1;
		$uid = getUserID($username);
		return true;
	} else {
		loginMsg('unable to read cookie');
		return false;
	}
} else {
	return false;
}
}

If you guys have any tips on how to resolve my core problem or improve the code, please let me know. 🙂