Login Script | New Think Tank

In this video tutorial I create an extremely secure PHP Login Script. If you didn’t watch part 20 of this tutorial, you should check it out to find out how to use PHP Sessions and Cookies.

To make this login secure I added all of the following security features:

Keep all user information stored on the server with Sessions
Run all input through very strict Regular Expressions
Use a CAPTCHA system to avoid brute force attacks (How to Setup Captcha)
Pass password information in encrypted form
Create a second token that changes on every page
Regenerate a new session token every time the user updates sensitive information

I add a few additional tricks along the way. All of the code follows the video. If you have any ideas on how I could improve this script pass them along.

Code From the Video

Goodlogin.php Script

<?php

// Initialize a session.

session_start();

require_once(“./includes/confighamdb.php”);

<?php

if (isset($_POST[‘submitted’])) { // Check if the form has been submitted.

if (preg_match (‘%^[A-Za-z0-9]\S{8,20}$%’, stripslashes(trim($_POST[‘userid’])))) {

$u = escape_data($_POST[‘userid’]);

} else {

$u = FALSE;

echo ‘<p><font color=”red” size=”+1″>Please enter a valid User ID!</font></p>’;

}

// FIX IT Check for a good password

if (preg_match (‘%^[A-Za-z0-9]\S{8,20}$%’, stripslashes(trim($_POST[‘pass’])))) {

$p = escape_data($_POST[‘pass’]);

} else {

$p = FALSE;

echo ‘<p><font color=”red” size=”+1″>Please enter a valid Password!</font></p>’;

}

// FIX IT PHP Code for the CAPTCHA System

$captchchk = 1;

require_once(‘./includes/recaptchalib.php’);

$privatekey = “privatekey”;

$resp = recaptcha_check_answer ($privatekey,

$_SERVER[“REMOTE_ADDR”],

$_POST[“recaptcha_challenge_field”],

$_POST[“recaptcha_response_field”]);

if (!$resp->is_valid) {

// What happens when the CAPTCHA was entered incorrectly

echo ‘<p><font color=”red” size=”+1″>The CAPTCHA Code wasn\’t entered correctly!</font></p>’;

$captchchk = 0;

}

// Query the database.

if ($u && $p && $captchchk) {

$query = “SELECT user_id, first_name, last_name, email, userid, pass FROM users WHERE userid=’$u’ AND pass=SHA(‘$p’)”;

$result = mysql_query ($query) or trigger_error(“Either the Userid or Password are incorrect”);

if (mysql_affected_rows() == 1) { // A match was made.

$row = mysql_fetch_array ($result, MYSQL_NUM);

mysql_free_result($result);

$_SESSION[‘first_name’] = $row[1];

$_SESSION[‘userid’] = $row[4];

// Create Second Token

$tokenId = rand(10000, 9999999);

$query2 = “update users set tokenid = $tokenId where userid = ‘$_SESSION[userid]'”;

$result2 = mysql_query ($query2);

$_SESSION[‘token_id’] = $tokenId;

session_regenerate_id();

header(“Location: http://localhost/login/index.php”);

mysql_close(); // Close the database connection.

exit();

}

} else { // No match was made.

echo ‘<br><br><p><font color=”red” size=”+1″>Either the Userid or Password are incorrect</font></p>’;

mysql_close(); // Close the database connection

exit();

}

echo ‘<br><br><p><font color=”red” size=”+1″>Either the Userid or Password are incorrect</font></p>’;

mysql_close(); // Close the database connection

exit();

}

// End of SUBMIT conditional.

<!DOCTYPE html PUBLIC “-//W3C//DTD XHTML 1.0 Strict//EN”

“http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd”>

<head>

<title>Good Login</title>

</head>

<body>

<?php

echo ‘<h1>Welcome’;

if (isset($_SESSION[‘first_name’])) {

echo “, {$_SESSION[‘first_name’]}!”;

}

echo ‘</h1>’;

// Display links based upon the login status

if (isset($_SESSION[‘userid’]) AND (substr($_SERVER[‘PHP_SELF’], -10) != ‘logout.php’)) {

echo ‘<a href=”logout.php”>Logout</a><br />

<a href=”change_password.php”>Change Password</a><br />’;

} else { // Not logged in.

echo ‘ <a href=”register.php”>Register</a><br />

<a href=”goodlogin.php”>Login to your account</a><br />

<a href=”forgot_password.php”>Forgot Password</a><br />’;

}

<h1>Login</h1>

<p>Your browser must allow cookies in order to log in.</p>

<p><b>Userid:</b> <input type=”text” name=”userid” size=”20″ maxlength=”20″ /></p>

<p><b>Password:</b> <input type=”password” name=”pass” size=”20″ maxlength=”20″ /></p>

<?php

require_once(‘./includes/recaptchalib.php’);

$publickey = “publickey”; // you got this from the signup page

echo recaptcha_get_html($publickey);

</fieldset>

</form>

</div>

</body>

</html>

Confighamdb.php Script

<?php

// Define these as constants so that they can’t be changed

DEFINE (‘DBUSER’, ‘mysqladm’);

DEFINE (‘DBPW’, ‘password’);

DEFINE (‘DBHOST’, ‘localhost’);

DEFINE (‘DBNAME’, ‘hamdb’);

if ($dbc = mysql_connect (DBHOST, DBUSER, DBPW)) {

if (!mysql_select_db (DBNAME)) { // If it can’t select the database.

// Handle the error.

trigger_error(“Could not select the database!<br />MySQL Error: ” . mysql_error());

exit();

} // End of mysql_select_db IF.

} else {

// Print a message to the user, and kill the script.

trigger_error(“Could not connect to MySQL!<br />MySQL Error: ” . mysql_error());

exit();

}

// A function that strips harmful data.

function escape_data ($data) {

// Check for mysql_real_escape_string() support.

// This function escapes characters that could be used for sql injection

if (function_exists(‘mysql_real_escape_string’)) {

global $dbc; // Need the connection.

$data = mysql_real_escape_string (trim($data), $dbc);

$data = strip_tags($data);

} else {

$data = mysql_escape_string (trim($data));

$data = strip_tags($data);

}

// Return the escaped value.

return $data;

} // End of function.