Making A Secure Login

Question

I have been trying to make a secure login for my site that I am developing.

I just cant get it to work, I use MySQL databases with PHP.

I can make the form to add the user and their info to the database but I can't seem to make it work with the login.

What type of encryption is used with HTML <input type="password">?

How do I keep the User logged in throughout their visit to my site?

I how do I securely check if it is the right password that matches the username?

I have been doing PHP for maybe a year now, I just haven't learned this part yet so it would be nice to know.

Answer 1

What type of encryption is used with html < input type=password >??

None. The input is just masked to protect against "Looking at the monitor" attacks.

If you want security, transmit your data over HTTPS (HTTP with SSL).

How do I keep the User logged in throughout their visit to my site?

Most people use cookies.

I how do i securely check if it is the right password that matches the username??

Securely?

Don't use a shared server. Follow the normal steps for keeping data on that server secure. Store passwords as hashes, not as plain text.

Check?

Convert the submitted password to the matching hash, then compare as normal. Assuming you store the data in a database, just SELECT FROM users WHERE user=? AND password=? and count the number of rows you get back.

Answer 2

I'll address the password protection portion of your question.

There is no built in encryption with the password input type. The browser will submit it as plain text just like everything else. There are two ways to protect the password.

The first is to set up a challenge/response system but this will require Javascript to work. Basically you take the user's password, apply a hashing function if that's the way it's stored on the server, then you take a server challenge token and salt the password value for a new hash. The server will take it's value of the password and apply the challenge as well. If they match the password is correct and there is no way for anyone to know what the actual password was. This requires javascript because the hash must be produced on the client side if this approach is to be effective.

Another, more simple option, is to require HTTPs for the log in portion of the site.

Answer 3

As David said there is no encryption of passwords by default, use https to keep encrypt.

To keep your user logged in, on the login page, check their password against what is stored in the database. You should hash your passwords, and store the hashed password in the database (see crypt). then when the user logs in, hash the password from the user, and compare it to the hashed password in the database. When they match, login, otherwise login fails. If your db ever gets compromised, at least they don't have the passwords.

To keep the user logged in, after you have checked the password, set a variable in the session, i.e

 $_SESSION[loggedin] = true.

On every request, check this session variable, and if it is true, allow access to the page, if it is false, redirect the user to the login page with a

 header("Location: /login.php");

Answer 4

password inputs are not encrypted. If you don't want to store plaintext passwords (as returned by the form) you should run one of the several functions provided by both php and mysql. check out php's md5, sha1, or mysql's encrypt for storing passwords.

Then, to check if they entered the correct password to log in, you can use whatever encryption method on their entry, retrieve the hashed password from the database and compare them. (Also, look into salting passwords)

To have a persistent login session, you can use php's $_SESSION variable. or setcookie()