5
\$\begingroup\$

I wrote my very first login/register PDO system today. I know there is still a lot of flaws, but I was wondering what tips and advice you have to help me improve this. I know that PDO is much more secure than MySQl, so would you say my code is secure? If so, to what extent, since I'm using PDO? Any tips and advice would be much appreciated!

login.php

<h1>Login</h1>
<form method="POST">
    <input type="text" name="username"><br />
    <input type="password" name="password"><br />
    <input type="submit">
</form>

<?php
session_start();
    if(isset($_POST['username'], $_POST['password'])){
        require 'core/connect.php';

        $query = dbConnect()->prepare("SELECT username, password FROM users WHERE username=:username AND password=:password");
        $query->bindParam(':username', $_POST['username']);
        $query->bindParam(':password', $_POST['password']);
        $query->execute();

        if($row = $query->fetch()){
            $_SESSION['username'] = $row['username'];
            header("Location: index.php");
        }
    }
?>

register.php

<h1>Register</h1>
<form method="POST">
    <input type="text" name="username"><br />
    <input type="password" name="password"><br />
    <input type="submit">
</form>

<?php
session_start();

    if(isset($_POST['username'], $_POST['password'])){
        require 'core/connect.php';

        $query = dbConnect()->prepare("INSERT INTO users (username, password) VALUES (:username, :password)");
        $query->bindParam(':username', $_POST['username']);
        $query->bindParam(':password', $_POST['password']);

        if($query->execute()){
            header("Location: index.php");
        } else{
            echo 'ERROR';
        }
    }
?>

index.php

<?php
session_start();

if(isset($_SESSION['username'])){
    echo 'Welcome!', '<a href="logout.php">Logout</a>';
} else {
    echo '<a href="login.php">Login</a><br />
    <a href="register.php">Register</a>';
}
?>

core/connect.php

<?php
    function dbConnect(){
        try{
            $username = 'root';
            $password = '';
            $conn = new pdo("mysql:host=localhost;dbname=test;", $username, $password);
            $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
            return $conn;

        }   catch(PDOException $e){
            echo 'ERROR', $e->getMessage();
        }
    }
?>
\$\endgroup\$
4
\$\begingroup\$

Here are several tips:

  • Use OOP - this way you could start the session only once
  • Hash your passwords - this way no one can steal it from the db, or at least the chance is lower
  • Use MVC - separate your HTML from the PHP code
  • Move your db connect credentials to the .ini file - this way it could be easily changed and .ini files can be cached by the server

Feel free to check my code for user authorization here in my pet project.

\$\endgroup\$

protected by Jamal Oct 26 '16 at 19:04

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.