Hi...
Have speant some time away from programming, so i need some updates!
I have written a small application for my company and an other company. Suddenly the security part smacked me in the head. This is the first time i actually must have a login to protect info. Nothing very important, but we dont want averyone lurking around being able to read everything.
Anyhow. When i first started to do some security on my own sites I did it like this:
<?php
session_start()
if (isset($_GET['logout'])) {
$_SESSION['login'] = false;
unset($_SESSION["user"]);
unset($_SESSION["status"]);
unset($_SESSION["name"]);
}
if($_SESSION['login'] == true && isset($_SESSION['user']) && isset($_SESSION['status'])){
//My Page with secret stuff
} else {
echo "Log in bastard";
}
?>
is this a good enugh way for keeping people out or is this old shit that is renewed?
There is offcource MD5 encryption on the passwords in the database, and the login script lookes like this:
<?php
session_start();
if($_GET['task'] == "login") {
$usr = !empty($_POST ['username']) ? $_POST['username'] : '';
$pass = !empty($_POST ['password']) ? $_POST['password'] : '';
$md5_pass = md5($pass);
include("admin/conn_us.php");
$query = "SELECT * FROM ${dbtable} WHERE brukernavn = '".mysql_real_escape_string($usr)."'";
if($result = mysql_query($query)) {
if(mysql_num_rows($result) <> 1) {
die("<p><span class='red'>Feil Brukernavn,".
"</p><p>Kontakt systemadministrator.</span></p>");
}
if($row = mysql_fetch_array($result)) {
if($row['passord'] == $md5_pass){
session_start();
$usr = $row['brukernavn'];
$name = $row['navn'];
$_SESSION["login"] = true;
$_SESSION["user"] = $usr;
$_SESSION["name"] = $name;
header("Location: http://bahrawy.net/dlight/ballroom/index.php");
exit;
} else {
echo "<span class='red'>Du har tastet feil passord</span>";
}}}} else {
echo '<p>
<form name="form1" method="post" action="login.php?task=login">
Brukernavn:<br>
<input type="text" name="username" id="username">
<br>
Passord:
<br>
<input type="password" name="password" id="password">
<br>
<input type="submit" name="submit" id="submit" value="Logg Inn">
</form>';
}
?>
Thanks for any inputt!
