How to Securely Implement a Member-Only Page Login System in PHP?
Nov 23, 2024 pm 01:21 PM
PHP: Secure Member-Only Pages with a Login System
Challenges with the Provided Code
The provided PHP code encounters several issues that hinder its functionality:
- Retrieval of Query Results: Instead of using $data1 = $conn->query($sql1);, the correct approach is to use $data = mysqli_fetch_array($conn->query($sql1)); or $data = $conn->query($sql1)->fetch_array(); to fetch the query results.
- Database Connection and Execution: The connection to the database should be established using $total = $data = 0; before executing any queries.
- MySQLi Syntax: The query for inserting the token should use backticks () around table and column names (INSERT INTO tokens (tk, gauth) VALUES (?,?)`) instead of single quotes.
- User Authentication: The authentication logic should return the result of the query instead of relying on boolean values ($result = $conn->query($sql3)->fetch_array();).
- Token Generation: The existing token generation method is not secure as it uses openssl_random_pseudo_bytes(). Instead, the code should use a cryptographically secure random number generator (CSPRNG) like random_bytes().
Proposed Solution
- Simplify Database Operations: Use a single query to retrieve user information and check credentials.
- Use Prepared Statements: Bind parameters to prevent SQL injection vulnerabilities.
- Generate Tokens Securely: Employ random_bytes() or a similar function for secure token generation.
- Store Authentication Data in Session: Save the authentication token in a session variable instead of a cookie.
- Validate Tokens: Perform a database query against the tokens table to validate the provided token.
Improved Code
The following revised code addresses the identified issues and provides a more secure member-only page login system:
<?php
session_start();
error_reporting(0);
$servername = "localhost";
$username = "root20";
$password = "jjewett38";
$db = "vws";
// Create connection
$total = $data = 0;
$conn = new mysqli($servername, $username, $password, $db);
// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
// Prepare statement for user authentication
$sql_auth = $conn->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
$sql_auth->bind_param("ss", $_POST['uname'], $_POST['pss']);
$sql_auth->execute();
$result_auth = $sql_auth->get_result();
// Authenticate user
if ($result_auth->num_rows > 0) {
$user = $result_auth->fetch_assoc();
$correct = TRUE;
} else {
$correct = FALSE;
}
// Generate token
if ($correct === TRUE) {
$hex = bin2hex(random_bytes(3));
$_SESSION['auth'] = $hex;
$_SESSION['logstat'] = TRUE;
}
// Close connection
$conn->close();
?>The above is the detailed content of How to Securely Implement a Member-Only Page Login System in PHP?. For more information, please follow other related articles on the PHP Chinese website!
Hot AI Tools
Undress AI Tool
Undress images for free
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Clothoff.io
AI clothes remover
Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Hot Topics
Establishing secure remote connections to a MySQL server
Jul 04, 2025 am 01:44 AM
TosecurelyconnecttoaremoteMySQLserver,useSSHtunneling,configureMySQLforremoteaccess,setfirewallrules,andconsiderSSLencryption.First,establishanSSHtunnelwithssh-L3307:localhost:3306user@remote-server-Nandconnectviamysql-h127.0.0.1-P3307.Second,editMyS
Understanding the role of foreign keys in MySQL data integrity
Jul 03, 2025 am 02:34 AM
ForeignkeysinMySQLensuredataintegritybyenforcingrelationshipsbetweentables.Theypreventorphanedrecords,restrictinvaliddataentry,andcancascadechangesautomatically.BothtablesmustusetheInnoDBstorageengine,andforeignkeycolumnsmustmatchthedatatypeoftherefe
Performing logical backups using mysqldump in MySQL
Jul 06, 2025 am 02:55 AM
mysqldump is a common tool for performing logical backups of MySQL databases. It generates SQL files containing CREATE and INSERT statements to rebuild the database. 1. It does not back up the original file, but converts the database structure and content into portable SQL commands; 2. It is suitable for small databases or selective recovery, and is not suitable for fast recovery of TB-level data; 3. Common options include --single-transaction, --databases, --all-databases, --routines, etc.; 4. Use mysql command to import during recovery, and can turn off foreign key checks to improve speed; 5. It is recommended to test backup regularly, use compression, and automatic adjustment.
Analyzing the MySQL Slow Query Log to Find Performance Bottlenecks
Jul 04, 2025 am 02:46 AM
Turn on MySQL slow query logs and analyze locationable performance issues. 1. Edit the configuration file or dynamically set slow_query_log and long_query_time; 2. The log contains key fields such as Query_time, Lock_time, Rows_examined to assist in judging efficiency bottlenecks; 3. Use mysqldumpslow or pt-query-digest tools to efficiently analyze logs; 4. Optimization suggestions include adding indexes, avoiding SELECT*, splitting complex queries, etc. For example, adding an index to user_id can significantly reduce the number of scanned rows and improve query efficiency.
Handling NULL Values in MySQL Columns and Queries
Jul 05, 2025 am 02:46 AM
When handling NULL values ??in MySQL, please note: 1. When designing the table, the key fields are set to NOTNULL, and optional fields are allowed NULL; 2. ISNULL or ISNOTNULL must be used with = or !=; 3. IFNULL or COALESCE functions can be used to replace the display default values; 4. Be cautious when using NULL values ??directly when inserting or updating, and pay attention to the data source and ORM framework processing methods. NULL represents an unknown value and does not equal any value, including itself. Therefore, be careful when querying, counting, and connecting tables to avoid missing data or logical errors. Rational use of functions and constraints can effectively reduce interference caused by NULL.
Resetting the root password for MySQL server
Jul 03, 2025 am 02:32 AM
To reset the root password of MySQL, please follow the following steps: 1. Stop the MySQL server, use sudosystemctlstopmysql or sudosystemctlstopmysqld; 2. Start MySQL in --skip-grant-tables mode, execute sudomysqld-skip-grant-tables&; 3. Log in to MySQL and execute the corresponding SQL command to modify the password according to the version, such as FLUSHPRIVILEGES;ALTERUSER'root'@'localhost'IDENTIFIEDBY'your_new
Calculating Database and Table Sizes in MySQL
Jul 06, 2025 am 02:41 AM
To view the size of the MySQL database and table, you can query the information_schema directly or use the command line tool. 1. Check the entire database size: Execute the SQL statement SELECTtable_schemaAS'Database',SUM(data_length index_length)/1024/1024AS'Size(MB)'FROMinformation_schema.tablesGROUPBYtable_schema; you can get the total size of all databases, or add WHERE conditions to limit the specific database; 2. Check the single table size: use SELECTta
Handling character sets and collations issues in MySQL
Jul 08, 2025 am 02:51 AM
Character set and sorting rules issues are common when cross-platform migration or multi-person development, resulting in garbled code or inconsistent query. There are three core solutions: First, check and unify the character set of database, table, and fields to utf8mb4, view through SHOWCREATEDATABASE/TABLE, and modify it with ALTER statement; second, specify the utf8mb4 character set when the client connects, and set it in connection parameters or execute SETNAMES; third, select the sorting rules reasonably, and recommend using utf8mb4_unicode_ci to ensure the accuracy of comparison and sorting, and specify or modify it through ALTER when building the library and table.
