PHP Login Script (Secure but not like a bank vault)

Question

Looking for a php login script. I've searched stackoverflow and have seen a lot of posts, but can anyone recommend the best method? Also, If I want to use hashing, how do you decode the password when retrieving? My iPhone app uses the same database and currently the passwords are stored in normal text (not very secure, I know).

Also, if I implement a login page that redirects to info.php, how do you stop the user from going directly to the info.php page without logging in, Session control?

Look forward to hearing your input. Thanks very much.

Answer 1

POST to a HTTPS URL.

You never decode the hashed password. Lost passwords need another mechanism to handle.

Yes, session control. Set a flag in the session on login and check for it on the other pages.

Answer 2

You don't need to decode the password, you will have to store the hashed password in your database, and when the user tries to login, you compare the stored password with the hash of the entered password.

About info.php, yes, if login succeeds you assign a variable in your session, and to test if the user is logged, you just test if that variable is assigned or not.

Answer 3

basically you hash your password so it cannot be retrieved for malicious purpose, the hash is stored in the database instead of the password in clear text, you only compare the 2 hash values.

your client can store the password as they want, but the web application should control at each step the session validity (store some logged in identifier in the session variables with proper expiration or something like that), so basically you require("session_control.inc") in every "protected" page so you could check for the session validity.

The best course would be to use an MVC framework which could help in defining the logic in that case.

Answer 4

This is a great tutorial on login system design. It covers all the major topics in an object oriented manner and is great for learning about the different considerations.

Decodable passwords are not as secure as they could be, but I've had clients insist that they be able to retrieve and change the password at will, no exceptions. So in some cases I opted to salt a base64 encoded string to store in the database, and that seems to work pretty well. A function exists to encode/decode as needed for the admin user.

Indeed, session control (and/or cookies) are the method to control access. Building it with an object oriented pattern would allow you to do that with just a line or two of code per page (or a line in a header if it's common).

My one warning is to consider if you have a common login level or need user-level permissions. It's significantly more work to decide after you've built the site that permissions-based logins are important. It can become a real monster if not planned for in the beginning.

Answer 5

You can use password hashing but there is also php's crypt() function http://php.net/manual/en/function.crypt.php

They essentially do the same thing but crypt is a little neater IMO. Make sure you also get a good salt generation script so when you save the password in the database here is my password encryption function, notice this isn't that secure without the salt function

function crypt_password($password)
{
    if($password){
        //blowfish hashing with a salt as follows: "$2a$", a two digit cost parameter, "$", and 22 base 64
        $blowfish = '$2a$10$';

        //get the random bytes and makes a salt
        $salt = $this->get_salt();

        //append salt2 data to the password, and crypt using salt, results in a 60 char output
        $crypt_pass = crypt($password,$blowfish . $salt);

        //blowfish comes out as 60, check
        $len = strlen($crypt_pass);

        if($len == 60)
        {
            return $crypt_pass;
        }
        else {
            throw new Exception('encryption failed');
            return false;
        }
    }
    else {
        throw new Exception('encryption failed, missing password');
        return false;
    }
}

and then when you want to verify this password you simply query the database for the login email or user id then to verify its as simple as

if (crypt($input_pass, $stored_pass) == $stored_pass) {
    return true;
}