Chud37 Posted January 19, 2012 Share Posted January 19, 2012 Hello, I just wanted some tips really and what people thought on the subject. For alot of my PHP applications I create a user control panel to manage the back end SQL databases. However these have to be hosted on the server and therefore I was thinking that they probably are not that secure. As far as I secure them so far I use a password system, sometimes with usernames and passwords; that is then taken through a form via POST method and then verified that way. I am completly aware is not that secure at all, so I want to up my game. I was thinking that maybe password protected directories would help? However last time I used them I was being asked for the username/password everytime I submitted a form which wasnt convenient. And what about session variables to store the user info/data/verify login? Is that secure enough? Please help! Thanks! ~Chud37 Link to comment https://forums.phpfreaks.com/topic/255371-creating-a-secure-login-on-public-website-domain/ Share on other sites More sharing options...
scootstah Posted January 19, 2012 Share Posted January 19, 2012 I'm not sure I follow. Are you storing the username and password in a php file? Link to comment https://forums.phpfreaks.com/topic/255371-creating-a-secure-login-on-public-website-domain/#findComment-1309316 Share on other sites More sharing options...
Chud37 Posted January 20, 2012 Author Share Posted January 20, 2012 no, Im just asking for the most secure way of doing it, Im not asking for help on how i'm doing it at all. But what is the general concensus out there for creating secure logins on PHP applications? how do others do it? Link to comment https://forums.phpfreaks.com/topic/255371-creating-a-secure-login-on-public-website-domain/#findComment-1309490 Share on other sites More sharing options...
scootstah Posted January 20, 2012 Share Posted January 20, 2012 With a database, using hashed passwords with salts. Link to comment https://forums.phpfreaks.com/topic/255371-creating-a-secure-login-on-public-website-domain/#findComment-1309543 Share on other sites More sharing options...
Chud37 Posted January 20, 2012 Author Share Posted January 20, 2012 Alright, hash passwords are good and all. But what about the actual login process? Are sessions acceptable, or is there another method? Link to comment https://forums.phpfreaks.com/topic/255371-creating-a-secure-login-on-public-website-domain/#findComment-1309548 Share on other sites More sharing options...
RobertP Posted January 21, 2012 Share Posted January 21, 2012 Php sessions should not store more then a key. This key should then be used on every page load to fetch the required page information from a database, mysql,sqlite,etc. If some how your sessions directory is compromised, then there is no data leaked that should not be. Link to comment https://forums.phpfreaks.com/topic/255371-creating-a-secure-login-on-public-website-domain/#findComment-1309787 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.