I have been using this code for a while. I got it from a tutorial 5 years back. Now I'm wondering if it still is secure, or if it's time to find a new one? Maybe it has never been secure enough.
LOGIN
<?php
//Connect to database
require("include/config.php");
//Empty Variable
$submitted_username = '';
//Check if something is posted
if(!empty($_POST)){
//Check if user exists
$query = "SELECT * FROM usrs WHERE usr_email = :usr_email";
$query_params = array(':usr_email' => $_POST['usr_email']);
try{
$stmt = $db->prepare($query);
$result = $stmt->execute($query_params);
}
catch(PDOException $ex){ die("Failed to run query: " . $ex->getMessage()); }
//Fetch result
$row = $stmt->fetch();
//Reset var
$login_ok = false;
//If usr exists, check password
if($row){
//Check if password matches
$check_password = hash('sha256', $_POST['usr_password'] . $row['usr_salt']);
for($round = 0; $round < 65536; $round++){
$check_password = hash('sha256', $check_password . $row['usr_salt']);
}
if($check_password === $row['usr_password']){
$login_ok = true;
}
}
//LOGIN OK
if($login_ok){
//UNSET VARS
unset($row['usr_salt']);
unset($row['usr_password']);
//LOG USR LOGIN DATA
$dateTime = date('Y-m-d H:i:s');
//Create array
$usr_data = array(
':usr_id' => $row['id'],
':usr_name' => $row['usr_fname']. " " . $row['usr_lname'],
':dateTime' => $dateTime,
':ip' => $_SERVER['REMOTE_ADDR']
);
//CREATE SESSION
$_SESSION['usr'] = $row;
//REDIRECT TO STARTPAGE
header("Location: start.php");
}
else{
echo "<script type='text/javascript'>alert('Fel uppgifter..');</script>";
$submitted_username = htmlentities($_POST['usr_email'], ENT_QUOTES, 'UTF-8');
}
}
?>
CONFIG
$options = array(PDO::MYSQL_ATTR_INIT_COMMAND => 'SET NAMES utf8');
try { $db = new PDO("mysql:host={$host};dbname={$dbname};charset=utf8", $username, $password, $options); }
catch(PDOException $ex){ die("Failed to connect to the database: " . $ex->getMessage());}
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$db->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC);
//SET HEADER
header('Content-Type: text/html; charset=utf-8');
//START SESSION
if(!isset($_SESSION)){
session_start([
'cookie_lifetime' => 86400,
]);
}
//SET TIMEZONE
date_default_timezone_set('Europe/Stockholm');
?>
CHECK IF LOGGED IN
<?php
//CHECK IF USR IS LOGGED IN
if(empty($_SESSION['user'])){
echo "<script>window.location = '/index.php'</script>";
die("Redirecting to index.php");
}
hash
function 65537 times? \$\endgroup\$