I'm working on CMS in PHP just for fun. Right now I'm trying to implement class for working with users/passwords. I had been reading lot of articles about hashing and as far as I understood crypt()
function are the best(most secure) for now.
class Users {
private static $key, $table, $logtable;
public static function init($key) {
self::$key = $key;
self::$table = DBPREFIX.$key.'s';
self::$logtable = self::$table.'_access_log';
}
public static function isLogged() {
if(isset($_SESSION[self::$key])) {
if(isset($_SESSION[self::$key]['uid'])) {
$uid = intval($_SESSION[self::$key]['uid']);
$user = DB::select()->from(self::$table)->where('id', '=', $uid)->execute()->object();
if(count($user) > 0) {
return true;
}
else {
return false;
}
}
else {
return false;
}
}
else {
return false;
}
}
public static function userExist($login) {
$user = DB::select()->from(self::$table)->where('login', '=', $login)->execute()->object();
if(count($user) > 0) {
return true;
}
else {
return false;
}
}
public static function getUser($login) {
$user = DB::select()->from(self::$table)->where('login', '=', $login)->execute()->object();
if(count($user) > 0) {
return $user[0];
}
else {
return false;
}
}
public static function generateHash($password) {
$salt = self::generateSalt();
$hashedPassword = crypt($password, $salt);
return array('hashed_password' => $hashedPassword, 'salt' => $salt);
}
private static function generateSalt() {
$blowfishPre = '$2y$10$';
$blowfishEnd = '$';
$allowedChars ='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789./';
$charsLength = strlen($allowedChars);
$saltLength = 20;
$salt = "";
for($i=0; $i < $saltLength; $i++)
{
$salt .= $allowedChars[mt_rand(0,$charsLength)];
}
$bcrypt_salt = $blowfishPre . $salt . $blowfishEnd;
return $bcrypt_salt;
}
public static function comparePasswords($input, $uid) {
$user = DB::select()->from(self::$table)->where('id', '=', $uid)->execute()->object();
if(count($user) > 0) {
$user = $user[0];
$password = $user->password;
return crypt($input, $password) === $password;
}
else {
return false;
}
}
public static function userExit() {
if(isset($_SESSION[self::$key])) {
unset($_SESSION[self::$key]);
}
}
public static function changePassword($password, $uid) {
$newPassword = self::generateHash($password);
if(isset($newPassword['hashed_password']) && isset($newPassword['salt'])) {
DB::update(self::$table)->set(array('password' => $newPassword['hashed_password'], 'salt' => $newPassword['salt']))->where('id', '=', $uid)->execute();
}
}
public static function updateTime($uid) {
DB::update(self::$table)->set(array('last_login' => time()))->where('id', '=', $uid)->execute();
}
public static function writeAccessLog($uid, $success) {
if($success) {
DB::insert(self::$logtable)->set(array('admin_id' => $uid, 'date' => time(), 'success' => '1'))->execute();
}
else if(!$success) {
DB::insert(self::$logtable)->set(array('admin_id' => $uid, 'date' => time(), 'success' => '0'))->execute();
}
}
}
Please, take a look and let me know if I doing something wrong.