PHP Password Protection

views:

answers:

PHP Password Protection

Hey guys,

I'm making a site and it needs to have user authentication. Currently, I'm using HTTP/Basic Auth for proof of concept/development, but this is not good in production for obvious reasons(ugly, insecure, can't read from mysql db, sucky). So, I know how to do some basic auth stuff, like getting in the username and password, salting it, and matching it against the database, but what I don't know is how to do sessions and making the scripts actually protected(right now index.php is the login page and sends you to startpage.php if you pass, but you could just go straight to startpage.php and you would be "breaking in").

Thanks,
deftonix

Have a look at this article.

ChristopheD 2009-12-20 18:53:51

With this article's solution, is there not a security hole in registration where the password is sent via POST from register_form.inc.php to register.php? How would this be mitigated if it is indeed, a hole?

deftonix 2009-12-20 19:25:53

Could you explain where the security hole would be. Only a man-in-the-middle attack could be done (theoretically) I think, but the only way to avoid that is simply to switch to https instead of http. If you liked this answer i would appreciate the upvote (it's the up arrow just above the '0' next to this question).

ChristopheD 2009-12-20 22:58:29

This is a really big question. So I'll just post this screen-cast that goes trough all of that : http://net.tutsplus.com/videos/screencasts/how-to-build-a-login-system-for-a-simple-website/

Jan Hančič 2009-12-20 18:53:56

ansaurus

tags:

views:

answers:

PHP Password Protection

related questions