PDO login script

Question

Just started using PDO for my newest project. I'd like to get input on how this login script looks and if I should alter it in any way.

When the user clicks the link to the index.php page, a script immediately fires and checks if the windows username exists in the users table in the DB.

<?php
include("include/sessions.php");

$windowusername = $_SERVER['REMOTE_USER'];

$sql = 'SELECT , username, fullname, email FROM users WHERE username = :username';
$sth = $dbc->prepare($sql, array(PDO::ATTR_CURSOR => PDO::CURSOR_FWDONLY));
$sth->execute(array(':username' => $windowusername));
$res = $sth->fetchAll(PDO::FETCH_ASSOC);

$numrows = count($res);

if($numrows == 1)
{
  foreach($res as $row)
  {
    $_SESSION['user'] = $row;
  }
  header('Location: home.php');
}
else
{
  header('Location: chassisRegistration.php');
}
$this->connection = null; // <- wasn't sure if this is necessary
?>

All of the above works without any errors.

As long as the windows username exists in the users table, the session variable is set, then route the user to the home page.

If the user does not exist, route them to the registration page.

I would appreciate any input on how this script looks. Please let me know if there is anything I should do differently.

Thank you in advance.

Answer 1

For one, fetchAll() is not the only method to get the result from a query with PDO. When you are expecting a single row, you should use a function for the exact purpose - fetch(). It will make your code meaningful, readable and concise:

$row = $sth->fetch(PDO::FETCH_ASSOC);
if($row) { 
    $_SESSION['user'] = $row;
    header('Location: home.php');
}

Also, I am not sure about security. I don't know your conditions but in the wild it is very easy to forge REMOTE_USER by requesting your site like this: http://fake_username:[email protected]/

So at least make sure that it's indeed an existing windows user is set in REMOTE_USER all the time (depends on your conditions, server settings etc).