2
\$\begingroup\$

Can you guys tell me if my login is secure?

Login.php

<?php include 'session.php';?>
<?php


if(isset($_POST['username'])){
include 'dbh.inc.php';

$uname=$_POST['username'];
$password=$_POST['password'];
$secretcode=$_POST['secretcode'];

if (empty($uname) || empty($password) || empty($secretcode)) {
  header("Location: ../index.php?login=empty");
} else {
    $sql="select * from loginform where User = ? AND SCode= ? limit 1";
    $stmt = mysqli_stmt_init($conn);
    if (!mysqli_stmt_prepare($stmt, $sql)) {
     header("Location: ../index.php?error=error");
    } else {
     mysqli_stmt_bind_param($stmt, "ss", $uname, $secretcode);
     if (mysqli_stmt_execute($stmt) == true) {
       $result = $stmt->get_result();
       if ($row = mysqli_fetch_assoc($result)) {
       $hashedpsw = password_verify($password, $row['Pass']);
       if ($hashedpsw == true) {
         $_SESSION['Admin']=$uname;
         // Log in
         header('Location: ../index.php?login=success');
         exit();
       } else {
         header("Location: ../index.php?login=error");
         exit();
       }
     } else {
       header("Location: ../index.php?login=error");
     }
   } else {
     header("Location: ../index.php?login=error");
   }
 }
}
} else {
header("Location: ../page-not-found.php");
}
?>

session.php

<?php
ini_set('session.use_only_cookies', 1);
session_set_cookie_params(0,'/','localhost',false,true);
session_start();
session_regenerate_id();
?>

hashing script

password_hash("test", PASSWORD_BCRYPT, array('cost' => 12));

index.php form

<form action="phpfunctions/checklogin.php" method="POST">
         <input type="text" name="username" placeholder="Username">
         <input type="password" name="password" placeholder="Password">
         <input type="password" name="secretcode" placeholder="****" 
maxlength="4">
         <button name="submit">LOGIN</button>
       </form>

index.php

<?php
include 'phpfunctions/s-session.php';
if (!isset($_SESSION['Admin'])) {
  $_SESSION['requestUrl'] = $_SERVER['REQUEST_URI'];
}
?>

<!DOCTYPE html>
<html lang="eu">
<head>
<!-- All meta -->
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=0.5">
<meta http-equiv="Pragma" content="no-cache" />
<meta http-equiv="Cache-Control" content="no-cache" />
<link rel="icon"href="https://orig00.deviantart.net/60fe/f/2011/265/b/3/lsi_logo_icon_256_png_by_mahesh69a-d4an1lt.png">
<meta name="description" content="Shaadyy Website - Home | Gallery | FAQ | 
Contact">
<meta name="keywords" content="Shaadyy Website KS Kasai Clan Web Programmer 
Designer">
<meta name="author" content="Shaadyy">
<!-- Sites Information -->
<title>Home - Shaadyy</title>
<!-- Custom Fonts -->
<link href="https://fonts.googleapis.com/css?family=Lato|Open+Sans|Roboto" 
rel="stylesheet">
<link rel="stylesheet" 
href="https://use.fontawesome.com/releases/v5.1.0/css/all.css" 
integrity="sha384- 
lKuwvrZot6UHsBSfcMvOkWwlCMgc0TaWr+30HWe3a4ltaBwTZhyTEggF5tJv8tbt" 
crossorigin="anonymous">
<!-- My src css files -->
<link rel="stylesheet" href="src/css/index.css">
<link rel="stylesheet" href="src/css/main.css">
<!-- My src javascript files -->
<script 
src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"> 
</script>
<script src="src/js/nav-opacity.js"></script>
<script src="src/js/scroll-elements.js"></script>
</head>
<body>
<!-- ( Navbar ) -->
<header id="Header">
<div class="nav-content">
 <div class="Header-Title"><h1>Shaadyy</h1></div>
 <div class="Nav-Items">
   <nav>
     <ul>
       <li><a href="#Main-S">Home</a></li>
       <li><a href="Gallery.php">Gallery</a></li>
       <li><a href="faq.php">Faq</a></li>
       <li><a class="ContactBtn" href="">Contact</a></li>
       <?php
       if (isset($_SESSION['Admin'])) {
       echo '<li><a href="Settings.php"><i class="fas fa-cog"></i></a> 
</li>';
       echo '<li><a href="phpfunctions/logout.php"><i class="fas fa-sign- 
out-alt"></i></a></li>';
       }
       ?>
     </ul>
   </nav>
 </div>
</div>
</header>
<!-- ( Body Elements ) -->
<main>
 <div id="Main-S" class="Main-Section">
   <div class="Main-S-Content">
       <h1>Web Developer</h1>
       <h2>Are You Interested? Contact Me</h2>
       <button class="ContactBtn">Contact</button>
       <h3>See More About Me</h3>
       <i id="SeeMoreBtn" class="fas fa-angle-double-down"></i>
   </div>
 </div>
 <div id="AboutMe-S" class="AboutMe-Section">
   <div class="AboutMe-S-Content">
     <div class="AboutMe-Photo Circle-50">
     </div>
     <div class="AboutMe-Information">
       <p>
       </p>
     </div>
   </div>
 </div>
 <div id="IG-S" class="IG-Section"> <!-- About Me Section -->
   <div class="IG-Content">
     <div class="IG-Logo"></div>
     <div class="IG-Button">
       <form action="https://www.instagram.com/mignaway/" target="_blank">
         <button>GO</button>
       </form>
     </div>
   </div>
 </div>
 <div id="OW-S" class="OW-Section"> <!-- OW Section -->
   <div class="OW-Background"></div>
   <div class="OW-Content">
     <div class="ow-logo"></div>
     <div class="ow-information">
       <?php
       include 'phpfunctions/owstats.php';
       echo '<h4 class="ow-nick">Nickname: <span>'.$nick.'</span></h4>
             <h4 class="ow-rank">Rank: <span>'.$rank.'</span></h4>
             <h4 class="ow-elo">Rank Elo: <span>'.$elo.'</span></h4>';
       ?>
     </div>
   </div>
 </div>
 <div id="Login-S" class="Login-Section">
   <div class="Login-Padding">
     <?php
     if (!isset($_SESSION['Admin'])) {
       echo '<h1>Login</h1>
       <form action="phpfunctions/login.php" method="POST">
         <input type="text" name="username" placeholder="Username">
         <input type="password" name="password" placeholder="Password">
         <input type="password" name="secretcode" placeholder="****" 
maxlength="4">
         <button name="submit">LOGIN</button>
       </form>';
     } else {
       echo '<h1>Already Logged</h1>
       <form action="phpfunctions/login.php" method="POST">
         <input type="text" name="username" placeholder="Username" disabled>
         <input type="password" name="password" placeholder="Password" 
disabled>
         <input type="password" name="secretcode" placeholder="****" 
maxlength="4" disabled>
         <button disabled>LOGIN</button>
       </form>';
     }
     ?>
   </div>
 </div>
 <div id="Gallery-S" class="Gallery-Section">
   <div class="Gallery-Padding">
     <h1>Gallery</h1>
     <a href="Gallery.php"><h2>View All Photos</h2></a>
   </div>
 </div>
 <div id="Contact-S" class="Contact-Section">
   <div class="Contact-Padding">
     <h1>Contact Me</h1>
     <?php
         $requestUrl = "http://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";
         if (strpos($requestUrl, "email=notvalid") == true) {
           echo '<div class="Alert-Mex Error-Mex-Color"><p id="Alert-Mex">* 
Please, enter a valid e-mail *</p></div>';
         }
         elseif (strpos($requestUrl, "email=empty") == true) {
           echo '<div class="Alert-Mex Error-Mex-Color"><p id="Alert-Mex">* 
Please, fill out all required field *</p></div>';
         }
         elseif (strpos($requestUrl, "email=sent") == true) {
           echo '<div class="Alert-Mex Success-Mex-Color"><p id="Alert- 
Mex">* E-Mail Successfully Sent*</p></div>';
         }
     ?>
     <form action="phpfunctions/contact-send-mail.php" method="POST">
       <input type="text" name="c-fullname" placeholder="Full Name">
       <input type="text" name="c-email" placeholder="Your E-Mail">
       <textarea name="c-message" placeholder="Message"></textarea>
       <button name="c-submit">SEND</button>
     </form>
   </div>
 </div>
</main>
<!-- ( Bottom Page ) -->
<footer>
<div class="Footer-Items">
 <div class="Footer-Logo"></div>
 <h2>Thank you for visiting my website!</h2>
</div>
</footer>
</body>
</html>

(i called session.php on every page)

\$\endgroup\$
  • \$\begingroup\$ If secure connections are used the cookie's secure flag should be true. \$\endgroup\$ – aventurin Sep 17 '18 at 20:15
  • \$\begingroup\$ Please also include your index.php, since you reference it extensively. \$\endgroup\$ – 200_success Sep 17 '18 at 20:18
  • \$\begingroup\$ @aventurin it's already set true on my site \$\endgroup\$ – Simoneeee Sep 17 '18 at 20:19
  • \$\begingroup\$ @200_success i added just my form cause the rest it's just html and other php script. \$\endgroup\$ – Simoneeee Sep 17 '18 at 20:24
  • 1
    \$\begingroup\$ @200_success done. \$\endgroup\$ – Simoneeee Sep 17 '18 at 20:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.