My web project security

Question

I started a web project. Now I was wondering if it is secure enough. I followed some tutorials on HTS, but I can't see all holes (if there are any). Can you check my pages and if you can find any hole in it (like XSS or SQL injections). Thanks for helping :)!

My URL is: **

And another security question: is my HTTPS certificate safe enough? (**) And my SMTP/SSH/... services?

You can now login using: user: demo, password: test123

User controller code:

<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');

class User extends CI_Controller {

    public function create() {
        setHTTPS();
        if ($this->form_validation->run() == false) {
            $this->load->view('user/create');
        } else {
            $this->MUser->create();
            $this->load->view('user/email_sent');
        }
    }

    public function login() {
        setHTTPS();
        if ($this->form_validation->run() == false) {
            $this->load->view('user/login');
        } else {
            $this->MUser->createSession();
            $this->MUser->checkLogin();
            $this->load->view('user/dashboard');
        }
    }

    public function logout() {
        setHTTPS();
        if ($this->MUser->login()) {
            $this->MUser->logout();
            $this->load->view('user/logout');
        } else {
            $this->load->view('user/logout_failed');
        }
    }

    public function dashboard($username) {
        setHTTPS();
        $this->MUser->checkLogin();
        $this->load->view('/user/dashboard');
    }

    public function verify($userID, $code) {
        setHTTPS();
        $safeCode = urldecode($code);
        if ($this->MUser->checkVerifyCode($userID, $safeCode)) {
            $this->MUser->cleanVerifyCode($userID);
            $this->MUser->setActive($userID);
            mailSignupComplete($userID);
            $this->load->view('user/signup_complete');
        } else {
            $this->load->view('user/validation_failed');
        }
    }

    public function password($userID = null, $verifier = null) {
        setHTTPS();
        if ($userID !== null) {
            $safeCode = urldecode($verifier);
            if ($this->MUser->checkPasswordCode($userID, $safeCode)) {
                $this->MUser->updatePassword($userID);
                $this->load->view('user/password_succes');
            } else {
                $this->load->view('user/password_failed');
            }
        } else {
            if ($this->form_validation->run() == false) {
                $this->load->view('user/password');
            } else {
                $this->MUser->addRecoverPasswordEntry();
                $this->load->view('user/password_sent');
            }
        }
    }

}

/* End of file user.php */
/* Location: ./application/controllers/user.php */

Answer 1

Check your MySQL database. If you have another table called "websiteIsNotSecure" then you need to sanitize your database inputs. Also, it'd be easier to check security if we had some code to look at. You can't view PHP code, it's all parsed/executed on the server.