I am creating a social network and I've been told a few times a lot of things are outdated and prone to SQL injections so I am going over everything with a very fine comb and checking what's good and what's not good enough to launch on the web.
I have my login and signup pages and I want to know if it's good to hold sensitive things like: username
, first and last name
, email
and password
. And maybe an age.
Register.php:
<nav>
<form action="process2.php" method="post">
<input type="text" id="luname" required name="username" placeholder="Username...">
<input type="password" id="lpw" required name="pw" placeholder="Password..." >
<button id="bt2" type="submit" name="signin">Login</button>
</form>
</nav>
<h1 style="font-size: 40px; color: #cce6ff;">Join TheSocial</h1>
<form action="process.php" method="post">
<input id="uname" type="text" name="username" required placeholder="Username..."><p/>
<br>
<input id="pww" type="password" name="pw" required placeholder="Password..."><p />
<br>
<input id="cpw" type="password" name="pw2" required placeholder="Confirm Password..."><p />
<br>
<button type="submit" id="bt1" name="Register">Register</button>
</form>
process.php(signup page):
<?php
ini_set('display_errors', 1);
error_reporting(E_ALL);
//Initializing variable
$pw = "";
//$pw2 = ""; //Initialization value; Examples
//"" When you want to append stuff later
//0 When you want to add numbers later
//isset()
$pw = isset($_POST['pw']) ? $_POST['pw'] : '';
$pw2 = isset($_POST['pw2']) ? $_POST['pw2'] : '';
$success = array(); //holds success messages
$username = trim( isset($_SESSION['username']) ? $_SESSION['username'] : "" );
//check if form is submitted
if ( $_SERVER['REQUEST_METHOD'] != 'POST' || ! isset($_POST['Register'])) {
// looks like a hack, send to index.php
//header('Location: index.php');
//die();
}
require 'config/connect.php';
$errors = [];
// and so on...
if ($pw !== $pw2) {
$errors[] = "The passwords do not match.";
}
if (!$errors) {
//An SQL statement template is created and sent to the database
$stmt = $conn->prepare("SELECT * FROM users WHERE username=?");
// This function binds the parameters to the SQL query and tells the database what the parameters are.
$stmt->bind_param("s", $_POST['username']);
// the database executes the statement.
$stmt->execute();
$row = $stmt->get_result()->fetch_assoc();
if ($row && $row['username'] == $_POST['username']) {
$errors[] = "Username exists";
}
}
if (!$errors) {
$pw = password_hash($pw, PASSWORD_BCRYPT, array('cost' => 14));
$stmt = $conn->prepare("INSERT INTO users (username, pw) VALUES(?, ?)");
$stmt->bind_param("ss", $_POST['username'], $pw );
$stmt->execute();
$_SESSION["username"] = $_POST['username'];
header('Location: profile.php');
//die();
} else {
// The foreach construct provides an easy way to iterate over arrays.
foreach ($errors as $error) {
echo "$error <br /> \n";
}
echo '<a href="index.php">Try again</a><br />';
}
?>
process2.php(login):
<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);
require 'config/connect.php';
$username = trim( isset($_SESSION['username']) ? $_SESSION['username'] : "" );
//check if form is submitted
if ( $_SERVER['REQUEST_METHOD'] != 'POST' || ! isset($_POST['signin'])) {
// looks like a hack, send to index.php
header('Location: index.php');
die();
}
if (empty($_POST["username"])) {
echo 'Fill in username to sign in. <a href= index.php>Try again</a><br />';
die();
}
if (empty($_POST["pw"])) {
echo 'Fill in password to sign in. <a href= index.php>Try again</a><br />';
die();
}
$sql = "SELECT pw FROM users WHERE username = ?";
$stmt = mysqli_prepare($conn, $sql);
if ( !$stmt ) {
echo mysqli_error($conn);
die();
}
$stmt->bind_param('s', $_POST['username']);
if ( !$stmt->execute() ) {
echo mysqli_error($conn);
die();
}
// we found a row with that username,
// now we need to check the password is correct
// get the password from the row
$stmt->bind_result($hashed_pwd); // Binds variables to a prepared statement for result storage
$stmt->fetch(); // Fetch results from a prepared statement into the bound variables
if ( password_verify($_POST['pw'], $hashed_pwd) ) {
// password verified
$_SESSION["username"] = $_POST['username'];
header('Location: profile.php');
} else {
echo 'Incorrect username or Password. <a href= index.php>Try again</a><br />';
}
?>
password_verify
? \$\endgroup\$ – vnp Jun 7 '20 at 20:48