How Secure Is This Login System? (Using Cookies In PHP)

by

Here’s a non-exhaustive list of problems/solutions:

  • Your code is difficult to read because it is not properly indented.
  • You should use prepared statemens to guard against SQL-injection.
  • You give hints to hackers by having different error messages. When the username is correct and the password wrong you say: “Login/Password Incorrect :(“, but if the username is wrong you say: “Username Not Found!”. That way a hacker can know if an username is correct, and half the job is done.
  • Better not use md5() for password encryption.
  • Use password_hash() for handling passwords.
  • Do not store the username in a cookie. Again, you’re leaking information.
  • Don’t use cookies, there’s just no need to do that, use sessions and store information on the server, not on the user’s machine.
  • You seem to have stored usernames as phone_number. So which one is it? It is either an username or a phone number, it cannot be both. Even if you use phone numbers as user names, call them what they are.
  • Sloppy coding: $errors = array(); is not used anywhere. You don’t check the result of new mysqli(), the connection might fail. Same is true for $mysqli->query().
  • You take care to close the database, but then why don’t you release the query result with $result->close();? Either do both, or none.

Security is a difficult topic, it’s really hard to get it right, and what might be good today, might be bad tomorrow.

More Related Contents:

  1. How can I prevent SQL injection in PHP?
  2. SQL injection that gets around mysql_real_escape_string()
  3. Is “mysqli_real_escape_string” enough to avoid SQL injection or other SQL attacks?
  4. Reference: What is a perfect code sample using the MySQL extension? [closed]
  5. How to create a secure mysql prepared statement in php?
  6. How do I use password hashing with PDO to make my code more secure? [closed]
  7. What does it mean to escape a string?
  8. SQL injections in ADOdb and general website security
  9. PHP MySQLI Prevent SQL Injection [duplicate]
  10. Why is using a mysql prepared statement more secure than using the common escape functions?
  11. Are mysql_real_escape_string() and mysql_escape_string() sufficient for app security?
  12. How to best store user information and user login and password
  13. how safe are PDO prepared statements
  14. PHP setcookie “SameSite=Strict”?
  15. “slash before every quote” problem [duplicate]
  16. Hiding true database object ID in url’s
  17. a better approach than storing mysql password in plain text in config file?
  18. How do you set up use HttpOnly cookies in PHP
  19. phpmyadmin automatic logout time
  20. Session timeouts in PHP: best practices
  21. Best way to connect to MySQL with PHP securely [duplicate]
  22. Improve password hashing with a random salt
  23. What encryption algorithm is best for encrypting cookies?
  24. Save PHP array to MySQL?
  25. How to successfully rewrite old mysql-php code with deprecated mysql_* functions?
  26. Executing multiple SQL queries in one statement with PHP
  27. mysql_num_rows() expects parameter 1 to be resource, boolean given in [duplicate]
  28. Easy way to export a SQL table without access to the server or phpMyADMIN
  29. How can I count the numbers of rows that a MySQL query returned?
  30. Auto Increment skipping numbers?

Leave a Comment