I recently asked for a code review to my login system. This login system was fully directed to the user. Now I have added some code lines to print out some links related to the admin.
Basically I only added a condition on profile.php
:
if($_SESSION['email'] == '[email protected]'){
echo 'a link to a file that i will use to insert and update my tables'
}
And inside these files that I will use to insert/update data on my table I only added this line:
<?php
require_once '../../db.php';
session_start();
if( $_SESSION['logged_in'] != 1 || $_SESSION['email'] != '[email protected]'){
$_SESSION['message'] = "Algo deu errado :/";
header("location: ../error.php");
exit;
}else {
$username = $_SESSION['username'];
}
?>
I want to know if the way I did is correct, and if there's a safer way to do this
Below you can see the full code if you want.
login.php:
<?php
if($_SERVER['REQUEST_METHOD'] == 'POST'){
$email = trim($_POST['email']);
try{
$ckeckEmail = $conn->prepare("SELECT * FROM users WHERE `email` = :email");
$ckeckEmail->bindValue(':email', $email);
$ckeckEmail->execute();
$user = $ckeckEmail->fetch(PDO::FETCH_ASSOC);
$RowCount = $ckeckEmail->rowCount();
} catch (PDOerrorInfo $e){}
if( $RowCount == 0 ){
// User doesn't exist
$_SESSION['message'] = "Não existe um usuário com este e-mail.";
header("location: error.php");
exit;
} else{ // User exists
if( password_verify($_POST['password'], $user['password'])){
$_SESSION['email'] = $user['email'];
$_SESSION['user_id'] = $user['user_id'];
$_SESSION['first_name'] = $user['first_name'];
$_SESSION['last_name'] = $user['last_name'];
$_SESSION['username'] = $user['username'];
$_SESSION['img'] = $user['img'];
$_SESSION['capa'] = $user['capa'];
$_SESSION['logged_in'] = true;
header("location: ../?p=profile");
exit;
} else {
$_SESSION['message'] = "Password is incorrect";
header("location: error.php");
exit;
}
}
}
$conn = NULL;
register.php:
<?php
$img = rand(1,44);
$capa = rand(1,36);
$first_name = trim($_POST['first_name']);
$last_name = trim($_POST['last_name']);
$username = trim($_POST['username']);
$email = trim($_POST['email']);
$password = password_hash($_POST['password'], PASSWORD_BCRYPT);
$hash = md5( rand(0,1000) );
// Check if user with that email already exists
$result = $conn->prepare("SELECT * FROM users WHERE `email` = :email");
$result->bindParam(':email', $email);
$result->execute();
$RowCount = $result->rowCount();
if ( $RowCount > 0 ) {
$_SESSION['message'] = 'Já existe um usuário com este e-mail!';
header("location: error.php");
exit;
}
else {
$sql = "INSERT INTO users (dataR, ultima_atividade, first_name, last_name, username, img, capa, email, password, hash) VALUES (NOW(), NOW(), :first_name, :last_name, :username, :img, :capa, :email, :password, :hash)";
$sql = $conn->prepare($sql);
$sql->bindParam(':first_name', $first_name);
$sql->bindParam(':last_name', $last_name);
$sql->bindParam(':username', $username);
$sql->bindParam(':img', $img);
$sql->bindParam(':capa', $capa);
$sql->bindParam(':email', $email);
$sql->bindParam(':password', $password);
$sql->bindParam(':hash', $hash);
$sql->execute();
$_SESSION['message'] = 'Your account was created!';
header("location: success.php");
}
$conn = NULL;
profile.php:
<li class="pt-1 pb-2 liInfUs">
<h6>Nome: <?php echo htmlentities($first_name, \ENT_QUOTES, 'UTF-8', false).' '.htmlentities($last_name, \ENT_QUOTES, 'UTF-8', false); ?></h6>
<h6 class="quicksand300">Email: <?php echo htmlentities($email, \ENT_QUOTES, 'UTF-8', false); ?></h6>
</li>
<?php if($_SESSION['email'] == '[email protected]'){
$countUserOLN = $conn->query("SELECT * FROM users WHERE ultima_atividade >= NOW()-600");
$rstq = $countUserOLN->rowCount();
$countUserAll = $conn->query("SELECT * FROM users");
$rstAll = $countUserAll->rowCount();
?>
<li class="d-flex">
<h6 class="mr-3"><a href="verify/create/painel.php" style="color: #21D3FF">Painel</a></h6>
<h6 class="quicksand300 mr-3">Users: <?php echo $rstAll ?></h6>
<h6 class="quicksand300">Online: <?php echo $rstq ?></h6>
</li>
<?php } ?>