Raw passwords really shouldn't be kept in the database. If you ever have it compromised, you've just released those passwords and user-names. And if they don't change them from site to site (which 99% of people don't) then now that's edging on identity theft (well, virtual identity).
Typically people will use the md5() to hash the password. Although there are some instances where md5() just isn't enough. I personally like to use something like:
$password = md5($clean['post']['username'].md5($clean['post']['password']));
That way you're pretty much guaranteed that there is no way to generate the same password (since all usernames must be different). Depending upon what I'm doing, I'll either use a section of the username (first 5 letters) or split it up around the hashed password (bpat[hashed password]1434) or just append the hashed password. But you're looking for uniqueness and the ability to make it non-guessable by outsiders.
@:
In your code you have this:
if(!strcmp($inputuser ,$ADMIN_USER) && !strcmp($inputpassword,$ADMIN_PASSWORD)) {
$_SESSION['authenticated'] = 1;
header("Location:".$_SERVER[PHP_SELF]);
}
You'd best be served to call another function (validateUser) and have that return true or false. True means you set the cookie, false means something went wrong.
The function would look something like:
<?php
function validateUser()
{
include_once('../connections/finale_adminusers');
$conn = @mysql_connect($dbhost, $dbuser, $dbpass);
if(!is_resource($conn)) { return false; } // No connection to mySQL available
@mysql_select_db($database);
$query = sprintf("SELECT username FROM `users` WHERE username='%s' AND password='%s'",
mysql_real_escape_string($_POST['username']),
mysql_real_escape_string(md5($_POST['password'])) // The hashed password
);
$rslt = @mysql_query($query);
if(!is_resource($rslt)) { return false; } // No resource, no users match
if(mysql_num_rows($rslt) < 1) { return false; } // No rows, no users ;)
else
return true; // Had some rows, must have users
return false; // Just to make sure we have a backup.
}
So your code would turn into:
<?
// Import database connection *** NOT HERE, We will later though!! ***
// include("../connections/finale_adminusers");
session_start();
//$ADMIN_USER = "user"; // We don't need these anymore do we ;)
//$ADMIN_PASSWORD = "pass";
if(!$_SESSION['authenticated'])
if($_POST['loginbutton']) {
$inputuser = $_POST['input_user'];
$inputpassword = $_POST['input_password'];
if(validateUser()) {
$_SESSION['authenticated'] = 1;
header("Location:".$_SERVER[PHP_SELF]);
}
else
displayform(1);
}
else
displayform(0);
function displayform($error) {
echo "<html><head><title>Please login</title></head><body><style>body,td,input { font-family: verdana; font-size: 8pt; }</style>";
if($error) echo "<p><b>Wrong credentials.</b></p>";
echo "<form action=\"\" method=\"post\"><table width='400' border=0><tr><td width='100'>username:</td>";
echo "<td><input type='text' name='input_user'></td></tr><tr><td>password:</td><td><input type='password' name='input_password'></td></tr>";
echo "<tr><td colspan='2'><input type='Submit' value='Login»' name='loginbutton'></td></tr></table></form></body></html>";
exit;
}
function validateUser()
{
include_once('../connections/finale_adminusers');
$conn = @mysql_connect($dbhost, $dbuser, $dbpass);
if(!is_resource($conn)) { return false; } // No connection to mySQL available
@mysql_select_db($database);
$query = sprintf("SELECT username FROM `users` WHERE username='%s' AND password='%s'",
mysql_real_escape_string($_POST['username']),
mysql_real_escape_string(md5($_POST['password'])) // The hashed password
);
$rslt = @mysql_query($query);
if(!is_resource($rslt)) { return false; } // No resource, no users match
if(mysql_num_rows($rslt) < 1) { return false; } // No rows, no users ;)
else
return true; // Had some rows, must have users
return false; // Just to make sure we have a backup.
}
?>
Hope that helps. You'll need to tweak a few things though, like password matching for the query, table name in the query, and column names in the query.
