I'm new to PHP OOP programming and I'm trying to make a user class with login, register, logout and some other methods. I'm concentrating in the login method that will be used with Ajax.
Session class
class Session {
// these are global variables defined in the config file
private $lifetime = LIFETIME;
private $path = PATH;
private $domain = DOMAIN;
private $secure = SECURE;
private $http_only = HTTPONLY;
public function __construct($name) {
// method colled everytime an instance is called
// $lifetime, $path, $domain, $secure, $http_only
session_set_cookie_params($this->lifetime, $this->path, $this->domain, $this->secure, $this->http_only);
session_name($name);
session_start();
}
public function setVariable($name, $sv) {
// Sets the session variable
$_SESSION[$name] = $sv;
}
public function getVariables() {
// gets the session array with all variables
return $_SESSION;
}
public function getSingle($name) {
// displays the session variable
return $_SESSION[$name];
}
public function removeSessionVariable($name) {
// removes session variable
unset($_SESSION[$name]);
}
public function regenerate() {
// regenerates the id of session
session_regenerate_id();
}
public function killSession() {
// kills the sessions.
// to be used on logouts for example.
$_SESSION = array();
session_destroy();
}
}
User class
class User extends Session {
private $error = false;
private $msg = '';
private $fields = array();
private $result = array();
private $type = '';
private $db;
private $stmt;
public function __construct($dbh) {
$this->db = $dbh;
}
// verifies login form inputs
public function verifyLoginFields($username, $password, $token, $bot, $sv) {
if (strlen($username) < 3) {
$this->error = true;
array_push($this->fields, 'username');
}
if (strlen($password) < 3) {
$this->error = true;
array_push($this->fields, 'password');
}
if (strlen($bot) !== 0) {
$this->error = true;
array_push($this->fields, 'bot');
}
if ($token !== $sv) {
$this->error = true;
array_push($this->fields, 'token');
}
if ($this->error) {
return false;
} else {
return true;
}
}
// if no errors, proceed with login system
public function login($username, $password, $token, $bot, $sv) {
if($this->verifyLoginFields($username, $password, $token, $bot, $sv)) {
$query = "SELECT id, username, password, role FROM users WHERE username = :un";
$this->stmt = $this->db->prepare($query);
$this->stmt->bindParam(':un', $username, PDO::PARAM_STR);
if($this->stmt->execute()) {
if($this->stmt->rowCount() == 1) {
$row = $this->stmt->fetch();
$pass = htmlentities($row['password'], ENT_QUOTES, 'utf-8');
if(!password_verify($password, $pass)) {
$this->error = true;
array_push($this->fields, 'password');
$this->msg = 'Existem erros no formulário!';
$this->type = 'error';
}
else {
$this->type = 'success';
$this->msg = 'Redirecting...';
$this->setVariable('username', htmlentities($row['username'], ENT_QUOTES, 'utf-8'));
$this->setVariable('id', htmlentities($row['id'], ENT_QUOTES, 'utf-8'));
$this->setVariable('role', htmlentities($row['role'], ENT_QUOTES, 'utf-8'));
}
}
else {
$this->error = true;
array_push($this->fields, 'username');
$this->msg = 'Existem erros no formulario!';
$this->type = 'error';
}
}
else {
$this->type = 'error';
$this->msg = 'Fatal Error!';
}
}
else {
$this->type = 'error';
$this->msg = 'Existem erros no formulário!';
}
// Sets a new token value
$this->setVariable('token', bin2hex(random_bytes(32)));
$this->result = [
'type' => $this->type,
'msg' => $this->msg,
'fields' => $this->fields,
'token' => $this->getsingle('token')
];
echo json_encode($this->result);
}
}
The way I'm using this is this:
include_once('includes/config.php');
include_once('includes/session.class.php');
include_once('includes/login.class.php');
$session = new Session('login');
if (!isset($_SESSION['token'])) {
$session->setVariable('token', bin2hex(random_bytes(32)));
}
// $dbh comes from config file
$user = new User($dbh);
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
$username = $_POST['username'];
$password = $_POST['password'];
$token = $_POST['token'];
$bot = $_POST['user'];
$user->login($username, $password, $token, $bot, $session->getSingle('token'));
}
Right now, I'm only testing but this will be used with Ajax request. Am I on the right track? Any advice on how I can improve this class?
... here goes the database code ...
are not allowed at all. It should be a fully working code to be reviewed. \$\endgroup\$