Secure Login Script

[fresher_06]

I have the below basic PHP login script which I am using on my main website for the customers to log in ..Please let me know the potential threats in this script and any kind of loophole,which you feel ..any kind of suggestion will be highly appreciable ..

Here is the script --

http://pastebin.com/TtbBmKvJ

[MDCode]

It looks pretty secure sql injection wise. I can't think of a way to bypass the filtering you're using

Edited October 26, 2012 by ExtremeGaming

[requinix]

Besides minor things like not checking that the individual fields were submitted (I mean submitted, not filled in) and doing a SELECT * when all you need is their ID, name, and password,

 

You're giving a different error message for bad emails and bad passwords. That reveals to a malicious user that an account exists and lets them focus their efforts on finding a password. You should use the same "bad email and/or password" message in both cases.

[fresher_06]

@requinix ..

Now I am displaying same error message ""bad email and/or password" message in both cases , but i wanted to check if my script is vulnerable for sql injection or not as I have read somewhere that I should not allow negative numbers to enter.

 

Thanks

[OOP]

You may also want to validate both email and password fields, I mean the format, as extra security measures.

[Christian F.]

Passwords doesn't need to be validated on login, other than the matching hash check.

[Psycho]

Now I am displaying same error message ""bad email and/or password" message in both cases , but i wanted to check if my script is vulnerable for sql injection or not as I have read somewhere that I should not allow negative numbers to enter.

 

1. If you are going to use the same error message (which I absolutely agree with) you can greatly simplify the script. Instead of searching for a match on email and then extracting the password to compare, just do a query to find a match on email and the hashed password. That will cut out a lot of logic in your script. However, if you wanted to implement a locking feature (say for entering the wrong password three times in a row) then you would want to do a check only on the username (email address).

 

2. I don't see any problem in using a negative number for either the email or password. In fact, I can't think of any scenario where using a negative number as a search value in a query would be a security concern.