Patte12 Posted August 30, 2012 Share Posted August 30, 2012 Hi. I have a third-party application that needs to know if a login was succeed. I send the username and password to PHP and then PHP checks in the MySQL to see if it exist, if it exist then i simple use this "die("L-S");" to let my third-party application know that the login was succeed. Now my questions is, is this safe? Or is there another way of doing this. I'm worried that a person just could manipulate the PHP file to "die("L-S");" or something. Quote Link to comment https://forums.phpfreaks.com/topic/267796-php-security/ Share on other sites More sharing options...
gristoi Posted August 30, 2012 Share Posted August 30, 2012 seeign as your php script is stored on the server, if someone has the ability the alter your script then this is the least of your worries. Quote Link to comment https://forums.phpfreaks.com/topic/267796-php-security/#findComment-1373809 Share on other sites More sharing options...
Christian F. Posted August 30, 2012 Share Posted August 30, 2012 Your biggest concern in this situation is SQL injections and HTML injections, as well as securely storing your users' passwords. That's why I strongly recommend that you read this article about secure login systems, and preferably use the class (PHPpass) instead of trying to write your own code for this. Quote Link to comment https://forums.phpfreaks.com/topic/267796-php-security/#findComment-1373955 Share on other sites More sharing options...
xyph Posted August 30, 2012 Share Posted August 30, 2012 Is this all done locally? Why not simply skip the PHP middle-man? Quote Link to comment https://forums.phpfreaks.com/topic/267796-php-security/#findComment-1373991 Share on other sites More sharing options...
Christian F. Posted August 30, 2012 Share Posted August 30, 2012 Scratch my previous post, well.. Not completely, you still have to worry about SQL injections. However, as xyph pointed out (and I didn't notice earlier) is that you should indeed skip the middle-man. Have your application check directly. Otherwise, what's to stop anyone from simply replacing the PHP script or manually inputting the correct string to fool the application? Quote Link to comment https://forums.phpfreaks.com/topic/267796-php-security/#findComment-1373994 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.