1
\$\begingroup\$

Just started using PDO for my newest project. I'd like to get input on how this login script looks and if I should alter it in any way.

When the user clicks the link to the index.php page, a script immediately fires and checks if the windows username exists in the users table in the DB.

<?php
include("include/sessions.php");

$windowusername = $_SERVER['REMOTE_USER'];

$sql = 'SELECT , username, fullname, email FROM users WHERE username = :username';
$sth = $dbc->prepare($sql, array(PDO::ATTR_CURSOR => PDO::CURSOR_FWDONLY));
$sth->execute(array(':username' => $windowusername));
$res = $sth->fetchAll(PDO::FETCH_ASSOC);

$numrows = count($res);

if($numrows == 1)
{
  foreach($res as $row)
  {
    $_SESSION['user'] = $row;
  }
  header('Location: home.php');
}
else
{
  header('Location: chassisRegistration.php');
}
$this->connection = null; // <- wasn't sure if this is necessary
?>

All of the above works without any errors.

As long as the windows username exists in the users table, the session variable is set, then route the user to the home page.

If the user does not exist, route them to the registration page.

I would appreciate any input on how this script looks. Please let me know if there is anything I should do differently.

Thank you in advance.

\$\endgroup\$
  • \$\begingroup\$ You should be using exit() or __halt_compiler(); after using header(...).. The reason behide this because it can be possible to get into unvalid execution paths in the code when the html client is ignoring HTTP location headers.. \$\endgroup\$ – Raymond Nijland Feb 7 at 17:58
  • \$\begingroup\$ @RaymondNijland - Are you referring to the closing of the connection? \$\endgroup\$ – John Beasley Feb 7 at 18:39
  • \$\begingroup\$ No i was generally giving advice you need to use header('Location: home.php'); exit(); because its in fact a vulnerability to trust the HTTP client to respect the HTTP location header. "Are you referring to the closing of the connection?" And ideally this line of code should happen before anny redirects. \$\endgroup\$ – Raymond Nijland Feb 7 at 18:58
  • \$\begingroup\$ @RaymondNijland - thank you for your input. \$\endgroup\$ – John Beasley Feb 8 at 14:36
1
\$\begingroup\$

For one, fetchAll() is not the only method to get the result from a query with PDO. When you are expecting a single row, you should use a function for the exact purpose - fetch(). It will make your code meaningful, readable and concise:

$row = $sth->fetch(PDO::FETCH_ASSOC);
if($row) { 
    $_SESSION['user'] = $row;
    header('Location: home.php');
}

Also, I am not sure about security. I don't know your conditions but in the wild it is very easy to forge REMOTE_USER by requesting your site like this: http://fake_username:foo@example.com/

So at least make sure that it's indeed an existing windows user is set in REMOTE_USER all the time (depends on your conditions, server settings etc).

\$\endgroup\$
  • \$\begingroup\$ Thank you for your input. I have made the adjustment. \$\endgroup\$ – John Beasley Feb 7 at 13:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.