chrischen Posted February 5, 2008 Share Posted February 5, 2008 I'm trying to secure mywebsite before launch and I read some stuff about PHP session hijacking. Right now when a user login I just check their password and username against the database and if it checks out I put their first name, and their unique user Id in a session variable. For any pages that require login I just check to see if the user ID session variable is set. Any security risks with this? Quote Link to comment https://forums.phpfreaks.com/topic/89482-php-session-hijacking/ Share on other sites More sharing options...
Steve Angelis Posted February 5, 2008 Share Posted February 5, 2008 I would use an MD5 encyption also. Quote Link to comment https://forums.phpfreaks.com/topic/89482-php-session-hijacking/#findComment-458295 Share on other sites More sharing options...
chrischen Posted February 5, 2008 Author Share Posted February 5, 2008 Well yea i use sha1. I was just wondering if anything else in terms of sessions. Like perhaps storing the hashed password in the session too and checking it with the user id on every restricted page? Quote Link to comment https://forums.phpfreaks.com/topic/89482-php-session-hijacking/#findComment-458306 Share on other sites More sharing options...
haku Posted February 5, 2008 Share Posted February 5, 2008 The way you are doing it is a safe way. Only store one variable in your sessions, and anytime anything needs to be checked, use that variable to do a database query. However, if you have an admin section of your site, it would be best to store that as a separate session variable that is only ever stored on the computers of those with admin status. You should also have the admin table in your database stored as a completely separate table. The reason for this is that a person could potentially hack their session variable and find out their user id, then just start trying user IDs at random until they find one that is an admin. If the admin details are stored in a separate table, and a check is done with an entirely different session variable, they will never have the session variable on their computer to be able to hack, and hacking the one that they do have wont produce any results. Quote Link to comment https://forums.phpfreaks.com/topic/89482-php-session-hijacking/#findComment-458319 Share on other sites More sharing options...
chrischen Posted February 5, 2008 Author Share Posted February 5, 2008 But if i were to store the hashed password in a variable after login and check on every restricted page wouldn't that prevent the random guessing of user id problem? Quote Link to comment https://forums.phpfreaks.com/topic/89482-php-session-hijacking/#findComment-459110 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.