1
\$\begingroup\$

I have created a Login, Register ,welcomepage(userprofile with updatefunction). I have done that without thinking about security. Now I would like to improve the security on these pages.

Note: This is a School exercise and I don't really have much experience with php. What simple changes can be done to improve the security massively.(Save from SQL Injection...).

login.php:

<form class="form" action = "" method = "post">
                <hr id="gain" class="verticalline">
                <input id="email" type="text" name="email" value="Email@address.com" 
                        onblur="this.value'Email@address.com:this.value;'"
                        onfocus="this.select()"
                        onclick="if (this.value=='Email@address.com'){this.value=''; this.type='email'}"/>
                <input id="password" type="password" name="password" value="password"
                        onblur="this.value'Password:this.value;'"
                        onfocus="this.select()"
                        onclick="if (this.value=='Password'){this.value=''; this.type='password'}"/>


                <!----PHP Login Script---->
                <?php
                   include"../php/connection.php";
                   session_start();

                   if($_SERVER["REQUEST_METHOD"] == "POST") {
                      // username and password sent from form 

                      $myemail = mysqli_real_escape_string($db,$_POST['email']);
                      $mypassword = sha1($_POST['password']); 

                      $sql = "SELECT * FROM clients WHERE email = '$myemail' and password = '$mypassword'";
                      $result = mysqli_query($db,$sql);
                      $data = mysqli_num_rows($result);

                      // If result matched $myemail and $mypassword, table row must be 1 row

                        if($data == 1) {
                            $_SESSION['login_user'] = $myemail;
                            header("location:http://localhost:81/Left_over_youth_website/pages/welcome.php");
                        }else {
                            echo '<p id="error">Your Login Name or Password is invalid</p>';
                        }
                   }
                ?>
                <input id="button" type="submit" value="Log In" >
                <div class="links">
                    <a href="forgotpd.html" class="forpassword">Forgot Password?</a>
                    <a href="register.php" class="wannaregister">Create an Account?</a>
                </div>
            </form>

register.php:

<?php
        require('../php/connection.php');
        // If form submitted, insert values into the database.
        if (isset($_REQUEST['username'])){
                // removes backslashes
            $firstname = stripslashes($_REQUEST['firstname']);
            $firstname = mysqli_real_escape_string($db,$firstname);
            $lastname = stripslashes($_REQUEST['lastname']);
            $lastname = mysqli_real_escape_string($db,$lastname);
            $street = stripslashes($_REQUEST['street']);
            $street = mysqli_real_escape_string($db,$street);
            $streetnr = stripslashes($_REQUEST['streetnr']);
            $streetnr = mysqli_real_escape_string($db,$streetnr);
            $city = stripslashes($_REQUEST['city']);
            $city = mysqli_real_escape_string($db,$city);
            $plzz = stripslashes($_REQUEST['plzz']);
            $plzz = mysqli_real_escape_string($db,$plzz);
            $username = stripslashes($_REQUEST['username']);
                //escapes special characters in a string
            $username = mysqli_real_escape_string($db,$username); 
            $email = stripslashes($_REQUEST['email']);
            $email = mysqli_real_escape_string($db,$email);
            $password = stripslashes($_REQUEST['password']);
            $password = mysqli_real_escape_string($db,$password);
                $query = "INSERT into `clients` (firstname, lastname, street, streetnr, city, plzz, username, password, email)
        VALUES ('$firstname','$lastname','$street','$streetnr','$city','$plzz', '$username', '".sha1($password)."', '$email')";
                $result = mysqli_query($db,$query);
                if($result){
                    echo "<div class='form'>
        <h3>You are registered successfully.</h3>
        <br/>Click here to <a href='login.php'>Login</a></div>";
                }
            }else{
        ?>
        <form class="form" action="" method="post">
            <hr class="verticalline">
            <input class="inputfeldfirst" type="text" name="firstname" value="First name"
                        onblur="this.value'First name:this.value;'"
                        onfocus="this.select()"
                        onclick="if (this.value=='First name'){this.value=''; this.type='text'}"/>
            <input class="inputfeldlast" type="text" name="lastname" value="Last name"
                        onblur="this.value'Last name:this.value;'"
                        onfocus="this.select()"
                        onclick="if (this.value=='Last name'){this.value=''; this.type='text'}"/>
             <div>
                 <input class="inputfeldaddress" type="text" name="street" value="Street" 
                            onblur="this.value'Street:this.value;'"
                            onfocus="this.select()"
                            onclick="if (this.value=='Street'){this.value=''; this.type='text'}"/>
                <input class="inputfeldnr" type="text" name="streetnr" value="Nr" 
                            onblur="this.value'Nr:this.value;'"
                            onfocus="this.select()"
                            onclick="if (this.value=='Nr'){this.value=''; this.type='text'}"/>
            </div>
            <div>
                <input class="inputfeldcity" type="text" name="city" value="City"
                            onblur="this.value'City:this.value;'"
                            onfocus="this.select()"
                            onclick="if (this.value=='City'){this.value=''; this.type='text'}"/>
                <input class="inputfeldplz" type="text" name="plzz" value="Plz"
                            onblur="this.value'Plz:this.value;'"
                            onfocus="this.select()"
                            onclick="if (this.value=='Plz'){this.value=''; this.type='text'}"/>
            </div>
            <input class="inputfeldusername" type="text" name="username" value="Username"
                        onblur="this.value'Username:this.value;'"
                        onfocus="this.select()"
                        onclick="if (this.value=='Username'){this.value=''; this.type='Username'}"/>
            <input class="inputfeldemail" type="text" name="email" value="Email@address.com"
                        onblur="this.value'Email@address.com:this.value;'"
                        onfocus="this.select()"
                        onclick="if (this.value=='Email@address.com'){this.value=''; this.type='text'}"/>
            <input class="inputfeldpd" name="password" value="Password"
                        onblur="this.value'Password:this.value;'"
                        onfocus="this.select()"
                        onclick="if (this.value=='Password'){this.value=''; this.type='password'}"/>

            <input id="button" type="submit" name="button" value="Sign Up">
            <?php } ?>
            <a href="login.php" class="wannaregister">You already have an Account?</a>
        </form>

welcome.php:

<form class="form" action="" method="post">
                                <input id="username" class="username" type="text" name="username" value="<?php echo $_SESSION['username']; ?>" readonly>
                                <input id="email" class="email" type="text" name="email" value="<?php echo $_SESSION['email']; ?>" readonly>
                                <input id="firstname" class="firstname" type="text" name="firstname" value="<?php echo $_SESSION['firstname']; ?>" readonly>
                                <input id="lastname" class="lastname" type="text" name="lastname" value="<?php echo $_SESSION['lastname']; ?>" readonly>
                                <div>
                                    <input id="street" class="street" type="text" name="street" value="<?php echo $_SESSION['street']; ?>" readonly>
                                    <input id="nr" class="nr" type="text" name="streetnr" value="<?php echo $_SESSION['streetnr']; ?>" readonly>
                                </div>
                                <div>
                                    <input id="city" class="city" type="text" name="city" value="<?php echo $_SESSION['city']; ?>" readonly>
                                    <input id="plzz" class="plzz" type="text" name="plzz" value="<?php echo $_SESSION['plzz']; ?>" readonly>
                                </div>
                                <a href="#" class="editprofilelink" id="editprofilelink"  onclick="editable(); showbt()"; >Edit Profile</a>
                                <a href="changepd.php" class="editpasswordlink">Change Password</a>
                                    <!----------PHP Skript----------->
                                    <?php 
                                   if($_SERVER["REQUEST_METHOD"] == "POST") {
                                   $email = mysqli_real_escape_string($db,$_POST['email']);
                                   $username = mysqli_real_escape_string($db,$_POST['username']);
                                   $firstname = mysqli_real_escape_string($db,$_POST['firstname']);
                                   $lastname = mysqli_real_escape_string($db,$_POST['lastname']);
                                   $street = mysqli_real_escape_string($db,$_POST['street']);
                                   $streetnr = mysqli_real_escape_string($db,$_POST['streetnr']);
                                   $city = mysqli_real_escape_string($db,$_POST['city']);
                                   $plzz = mysqli_real_escape_string($db,$_POST['plzz']);


                                  $sql = "UPDATE clients SET " .
                                        "email = '$email', " .
                                        "username = '$username', " .
                                        "firstname = '$firstname', " . 
                                        "lastname = '$lastname', " .
                                        "street = '$street', " .
                                        "streetnr = '$streetnr', " .
                                        "city = '$city', " .
                                        "plzz = '$plzz' " .
                                        "WHERE username = '$username'";
                                   $result = mysqli_query($db,$sql);

                                   if($result) {
                                     $_SESSION["email"] = $email;
                                     $_SESSION["username"] = $username;
                                     $_SESSION["firstname"] = $firstname;
                                     $_SESSION["lastname"] = $lastname;
                                     $_SESSION["street"] = $street;
                                     $_SESSION["streetnr"] = $streetnr;
                                     $_SESSION["city"] = $city;
                                     $_SESSION["plzz"] = $plzz;

                                     header("location:http://localhost:81/Left_over_youth_website/php/logout.php");
                                   }else {
                                     echo '<p id="error">Update was not sucessful</p>';
                                   }
                                   }
                                 ?>  
                                <input hidden id="btupdate" type="submit" name="btupdate" value="Update">   
                            </form>

Connection.php:

   <?php
   define('DB_SERVER', 'localhost');
   define('DB_USERNAME', 'root');
   define('DB_PASSWORD', '');
   define('DB_DATABASE', 'leftoveryouth');  
   $db = mysqli_connect(DB_SERVER,DB_USERNAME,DB_PASSWORD,DB_DATABASE);
?>

session.php:

<?php
include('connection.php');
session_start();

$user_check = $_SESSION['login_user'];


$ses_sql = mysqli_query($db,"select * from clients where email = '$user_check'");

$row = mysqli_fetch_array($ses_sql,MYSQLI_ASSOC);

$_SESSION['email']=$row['email'];
$_SESSION['username']=$row['username'];
$_SESSION['firstname']=$row['firstname'];
$_SESSION['lastname']=$row['lastname'];
$_SESSION['birthdate']=$row['birthdate'];
$_SESSION['street']=$row['street'];
$_SESSION['streetnr']=$row['streetnr'];
$_SESSION['city']=$row['city'];
$_SESSION['plzz']=$row['plzz'];

if(!isset($_SESSION['login_user'])){
  header("location:http://localhost:81/Left_over_youth_website/pages/login.php");
}

?>

\$\endgroup\$
  • 1
    \$\begingroup\$ "I have done that without thinking about security." it is very hard to properly add "security" on something already existing. It has to be taken into account from the beginning. Also "security" covers a lot of different things... (starting with: use prepared statements for all your database queries) \$\endgroup\$ – Patrick Mevzek Apr 10 '18 at 20:05
  • \$\begingroup\$ I agree with Patrick. Especially with a login system. I have noticed something else: A lot of repetative code. This is not DRY. Why not define an array with the fields of your form and then loop over them with foreach? Like this: foreach ($fields as $field) $_SESSSION[$field] = $row[$field]; or perhaps even simpler, in this case: $_SESSION['allFields'] = $row;? \$\endgroup\$ – KIKO Software Apr 13 '18 at 9:33
  • \$\begingroup\$ @KIKOSoftware cause i am a complete noob in php and will never be able to get something like that to work \$\endgroup\$ – Hazaki Apr 13 '18 at 12:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.