gazalec Posted January 23, 2007 Share Posted January 23, 2007 Hi i was just wondering if you guys think this is secure or not, and any advice would be helpful. Well i have a customer login and the usernames and password are located on a MySQL database and when someone enters their username and password and then a query searching the table to match the username and password then gives a ref number which is then transferred into a URL using the Header(); option, at present each customer have their own folder and there is a security hole where on the url someone can change their folder name to another but i plan on getting round that by using .htaccess just wondering if there is any major security holes i am missing and how to improve that Link to comment https://forums.phpfreaks.com/topic/35378-how-safe-is-this-help/ Share on other sites More sharing options...
Snooble Posted January 23, 2007 Share Posted January 23, 2007 can you give the site name. I will check it for injections.Snooble Link to comment https://forums.phpfreaks.com/topic/35378-how-safe-is-this-help/#findComment-167208 Share on other sites More sharing options...
gazalec Posted January 23, 2007 Author Share Posted January 23, 2007 it aint uploaded yet i want to get rid of all the security problems first Link to comment https://forums.phpfreaks.com/topic/35378-how-safe-is-this-help/#findComment-167209 Share on other sites More sharing options...
Snooble Posted January 23, 2007 Share Posted January 23, 2007 ok well there's a lot of possible ways to manipulate script. The only way i could check is when it's online. But i suggest you just BETA it until you can iron out the errors.Snooble Link to comment https://forums.phpfreaks.com/topic/35378-how-safe-is-this-help/#findComment-167212 Share on other sites More sharing options...
gazalec Posted January 23, 2007 Author Share Posted January 23, 2007 ok thanks Link to comment https://forums.phpfreaks.com/topic/35378-how-safe-is-this-help/#findComment-167215 Share on other sites More sharing options...
trq Posted January 23, 2007 Share Posted January 23, 2007 Passing a reference number around the url is insecure. Why aren't you using sessiosn to log a user in? While not foolproof, they are alot stronger then what you presently have in place. Link to comment https://forums.phpfreaks.com/topic/35378-how-safe-is-this-help/#findComment-167217 Share on other sites More sharing options...
Snooble Posted January 23, 2007 Share Posted January 23, 2007 session riding could easily occur if users have access to files hosted on your server. But thorpe is right. It would incur much less. Link to comment https://forums.phpfreaks.com/topic/35378-how-safe-is-this-help/#findComment-167219 Share on other sites More sharing options...
gazalec Posted January 23, 2007 Author Share Posted January 23, 2007 no wot i mean is that if a customer number was 0800 then the username is 0800 the password is their password the ref would be 0800, so the url is then www.blahblah.com/customers/0800/index.htm it's not secret or anything i'm only novice level PHP user that why i'm asking for help and i was just wondering is there anyway the MySQL database can be downloaded? Link to comment https://forums.phpfreaks.com/topic/35378-how-safe-is-this-help/#findComment-167222 Share on other sites More sharing options...
Snooble Posted January 23, 2007 Share Posted January 23, 2007 simpley, no. But that's with my abilities.Snooble Link to comment https://forums.phpfreaks.com/topic/35378-how-safe-is-this-help/#findComment-167224 Share on other sites More sharing options...
gazalec Posted January 23, 2007 Author Share Posted January 23, 2007 well could anyone help me out with a secure login system because i cant come up with anything else Link to comment https://forums.phpfreaks.com/topic/35378-how-safe-is-this-help/#findComment-167226 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.