Is the following code secure when it is set to a cookie for cross-session authentication?
private function GenerateAuthKey($userid){
$ip = $_SERVER['REMOTE_ADDR'];
$user_agent = !empty($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : "";
$authkey = base64_encode(sha1(md5($this->GetDBPassword($userid) . $ip . $user_agent . time())));
$query = $this->db->buildquery("INSERT INTO member_session VALUES(%USERID%, '%AUTHKEY%', '%IP%', '%USERAGENT%', %EXPIRES%)", array("USERID" => $userid, "AUTHKEY" => $authkey, "IP" => $ip, "USERAGENT" => $user_agent, "EXPIRES" => time() + 30*24*60*60);
$this->db->query($query);
return $authkey;
}
private function ValidAuthKey($userid, $authkey){
$query = $this->db->buildquery("SELECT * FROM member_session WHERE user_id = %USERID% AND session_key = '%SESSION_KEY%'", array("USERID" => $userid, "AUTHKEY" => $authkey);
$result = $this->db->query($query);
if($result->num_rows){
$ip = $_SERVER['REMOTE_ADDR'];
$user_agent = !empty($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : "";
$row = $result->fetch_assoc();
if($row['ip'] != $ip){
return false;
}elseif($row['user_agent'] != $user_agent){
return false;
}elseif($row['expires'] < time()){
return false;
}else{
return true;
}
}else{
return false;
}
}