security issues in Login registration system using php javascript mysql

Question

I am building a web application from scratch that has registration and login functionality. I am completely a novice when it comes to security issues and attack like mysql injection. Apart from encryption of password in database, what are other security issues that i have to worry about?? And how do i take care of them?? Thank you

Answer 1

One thing you really need to look out for is Cross-site Request Forgery (CSRF or XSRF). The easiest way to prevent it is to send a token with each request (even sending a copy of the login cookie will work).

Answer 2

You need to make sure to sanitize all variables in your SQL, if you're not using something like PDO this is done most easily with mysql_real_escape_string

For example, when you are checking a users credentials your code would look something like:

$sql = "SELECT `id` FROM `users` WHERE `username` = '".mysql_real_escape_string($_POST['username'])."' AND `password` = '".mysql_real_escape_string($_POST['password'])."'";
$dosql = mysql_query($sql); // etc

It's also worth adding the following to your login routine to prevent session fixation.

session_regenerate_id(true);

Answer 3

You also have to worry about Cross-Site Scripting attacks. (Often shortened to XSS) Basically, it means that if your application ever makes data submitted by the user part of the HTML of a subsequent page, it must be sanitized. For example, if your application was a message board, a malevolent user could put up a post with embedded HTML that would load a remote javascript without the user's knowledge.

A simple way to defend against it is to encode any data that is made part of the HTML of your web application using a function that encodes HTML characters into entity codes. In PHP, you can use htmlspecialchars().

However, there's really a lot more you should consider. OWASP (The Open Web Application Security Project) is the industry group that really creates the standards in this area. They publish the OWASP Top Ten list, a list of the 10 most prevalent security vulnerabilities. You'll see everything mentioned in of these answers listed there.

Answer 4

Search for "login security issues," there are a number of good articles. This one is great: most common security mistakes. Go through every single answer that has a vote and make sure you know what it means and that you're not making that mistake. In short, to be secure, you must assume every piece of data from a user could be malicious.